oauthlint-rules 0.3.1 → 0.5.0

package/rules/go/flow/ssrf.yml

@@ -20,9 +20,11 @@ rules:
       link-local address ranges before dialing. See CWE-918.
     # Taint mode so indirection (target := r.FormValue("endpoint");
     # http.Get(target)) is caught, not just the inline form. The taint is
-    # cleared by an allow-list / host-validation helper, or by a
-    # url.Parse(...)-then-checked flow where the parsed host is vetted before
-    # the request is made.
+    # cleared by an allow-list / host-validation helper, or inside an
+    # `if`-guard that checks the parsed host against an allow-list. A bare
+    # `url.Parse(...)` is NOT a sanitizer: the parsed struct's Host/Path/Scheme
+    # are still attacker-controlled, so parse-then-use without a host check is a
+    # real SSRF and must still fire.
     mode: taint
     pattern-sources:
       # $R is the *http.Request. Cover the common net/http input shapes.
@@ -37,10 +39,17 @@ rules:
       - pattern: validateURL(...)
       - pattern: isAllowedHost(...)
       - pattern: $ALLOW.MatchString(...)
-      # url.Parse-then-checked: a parsed URL whose host has been inspected is
-      # treated as cleared (the request is built from a vetted destination
-      # rather than the raw untrusted string).
-      - pattern: url.Parse(...)
+      # parse-then-host-checked: a value used inside an `if`-guard that looks the
+      # parsed host up in an allow-list map is treated as vetted, mirroring the
+      # Python rule's `if is_allowed_url(...):` guard. A bare `url.Parse(...)` is
+      # deliberately NOT listed — it returns an attacker-controlled struct and
+      # does not validate anything, so parse-then-use still fires.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW[$U.Host] {
+                ...
+              }
     pattern-sinks:
       # Focus the URL argument so the finding lands on the tainted destination,
       # not the whole call. The plain call form is used (no aliasing) because

package/rules/java/cookie/insecure.yml

@@ -22,7 +22,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - servlet

package/rules/java/cors/allow-all.yml

@@ -38,7 +38,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - spring-web

package/rules/java/cors/credentialed-wildcard.yml

@@ -34,7 +34,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-cors-credentialed-wildcard
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-web

package/rules/java/crypto/noop-password-encoder.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.crypto.noop-password-encoder
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring stores passwords with no hashing.
+
+      `NoOpPasswordEncoder` keeps passwords in plaintext and
+      `withDefaultPasswordEncoder()` is a builder helper that Spring explicitly
+      marks for non-production use only. Either way the stored credential is not
+      hashed, so anyone who reads the database or a backup recovers every
+      password directly (CWE-256). This is a common AI-generated shortcut: the
+      no-op encoder is pasted in to "get login working" and never replaced.
+
+      Hash passwords with a dedicated, slow, salted algorithm. Use
+      `new BCryptPasswordEncoder()`, `Argon2PasswordEncoder`, or
+      `Pbkdf2PasswordEncoder` instead. A `DelegatingPasswordEncoder` built via
+      `PasswordEncoderFactories.createDelegatingPasswordEncoder()` is the
+      recommended default.
+    # Two literal sinks: the singleton no-op encoder and the deprecated
+    # User.withDefaultPasswordEncoder() builder helper. Both are tight enough
+    # that a match is always a real plaintext-password configuration.
+    pattern-either:
+      - pattern: NoOpPasswordEncoder.getInstance()
+      - pattern: $U.withDefaultPasswordEncoder()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-noop-password-encoder
+      category: security
+      cwe: CWE-256
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html
+        - https://cwe.mitre.org/data/definitions/256.html

package/rules/java/flow/ssrf.yml

@@ -0,0 +1,113 @@
+rules:
+  - id: auth.java.flow.ssrf
+    languages:
+      - java
+    severity: ERROR
+    # Non-production code (example apps, demos, docs, vendored copies, tests)
+    # is not the library surface users ship, so findings there are noise for a
+    # low-FP linter. Globs intentionally omit `**/test/**`-style fixture paths
+    # so the rule still fires on its own fixtures under rules/tests/fixtures/.
+    paths:
+      exclude:
+        - "**/src/test/**"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+        - "**/docs/**"
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+
+      Never build a request URL straight from a Spring `@RequestParam` /
+      `@RequestBody` value or a raw `HttpServletRequest.getParameter(...)` /
+      `getHeader(...)` value. Validate the destination against an explicit
+      allow-list of hosts (resolve the URL and check its host against the
+      allow-list, rejecting private/loopback ranges) before issuing the request
+      with `RestTemplate`, `WebClient`, OkHttp, or Apache HttpClient.
+    # Taint mode so indirection is caught — `String u = req.getParameter("url");
+    # restTemplate.getForObject(u, ...)` flags, not just the inline form.
+    # Passing the value through a host allow-list / validation guard
+    # (isAllowedUrl, validateUrl, assertAllowedHost, or an allow-list
+    # `contains(...)` if-guard) clears the taint, so a genuinely vetted
+    # outbound request does not fire.
+    mode: taint
+    pattern-sources:
+      # Spring MVC handler parameters annotated with @RequestParam / @RequestBody
+      # carry attacker-controlled request data. Focus the parameter so the taint
+      # tracks the value, not the whole method.
+      - patterns:
+          - pattern-either:
+              - pattern: "$RET $M(..., @RequestParam $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestParam(...) $T $P, ...) {...}"
+              - pattern: "$RET $M(..., @RequestBody $T $P, ...) {...}"
+          - focus-metavariable: $P
+      # Servlet API request accessors. Constrained to an HttpServletRequest
+      # receiver so unrelated `.getParameter(...)` / `.getHeader(...)` calls on
+      # other objects are not treated as untrusted input.
+      - pattern: (HttpServletRequest $REQ).getParameter(...)
+      - pattern: (HttpServletRequest $REQ).getParameterValues(...)
+      - pattern: (HttpServletRequest $REQ).getHeader(...)
+    pattern-sanitizers:
+      # Routing the value through a host allow-list / validation helper clears
+      # the taint: only the vetted destination (not the raw request input)
+      # reaches the request.
+      - pattern: isAllowedUrl(...)
+      - pattern: isAllowedHost(...)
+      - pattern: validateUrl(...)
+      - pattern: assertAllowedHost(...)
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (allow.contains(...)) { ... }` is treated as validated, mirroring the
+      # Python rule's `if is_allowed_url(v): ...`. The boolean-returning
+      # membership call itself does NOT sanitize (that clears only the boolean),
+      # so taint is cleared by the if-guard.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if (<... $ALLOW.contains(<... $V ...>) ...>) { ... }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination,
+      # not the whole call.
+      - patterns:
+          - pattern-either:
+              # Spring RestTemplate.
+              - pattern: $RT.getForObject($URL, ...)
+              - pattern: $RT.getForEntity($URL, ...)
+              - pattern: $RT.postForObject($URL, ...)
+              - pattern: $RT.postForEntity($URL, ...)
+              - pattern: $RT.exchange($URL, ...)
+              - pattern: $RT.execute($URL, ...)
+              # Spring WebClient fluent URI.
+              - pattern: $WC.uri($URL)
+              - pattern: $WC.uri($URL, ...)
+              # OkHttp Request.Builder.
+              - pattern: $B.url($URL)
+              # Apache HttpClient request objects.
+              - pattern: new HttpGet($URL)
+              - pattern: new HttpPost($URL)
+              - pattern: new HttpPut($URL)
+              - pattern: new HttpDelete($URL)
+              - pattern: new HttpHead($URL)
+              # JDK URL/URI opened directly.
+              - pattern: new URL($URL)
+              - pattern: new URI($URL)
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-FLOW-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - spring
+        - resttemplate
+        - webclient
+        - okhttp
+        - apache-httpclient
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/java/session/fixation-disabled.yml

@@ -25,7 +25,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/java-session-fixation-disabled
       category: security
       cwe: CWE-384
-      owasp: A07:2021
+      owasp: API2:2023
       llm-prevalence: MEDIUM
       technology:
         - spring-security

package/rules/java/tls/trust-all-certs.yml

@@ -21,13 +21,24 @@ rules:
     # HttpClient's NoopHostnameVerifier. A HostnameVerifier with real
     # (non-trivial) logic and the default verifier are not matched.
     pattern-either:
-      # Lambda that always returns true: (hostname, session) -> true
-      - pattern: ($HOST, $SESSION) -> true
-      # Anonymous HostnameVerifier whose verify(...) just returns true.
-      - pattern: |
-          new HostnameVerifier() {
-            public boolean verify(String $H, SSLSession $S) { return true; }
-          }
+      # Lambda that always returns true, scoped to a hostname-verifier context
+      # so a generic two-arg lambda (BiPredicate, comparator, etc.) returning
+      # true is not mistaken for a permissive verifier.
+      - patterns:
+          - pattern: ($HOST, $SESSION) -> true
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
+      # Anonymous HostnameVerifier whose verify(...) just returns true, scoped to
+      # where it is actually installed as the verifier.
+      - patterns:
+          - pattern: |
+              new HostnameVerifier() {
+                public boolean verify(String $H, SSLSession $S) { return true; }
+              }
+          - pattern-either:
+              - pattern-inside: $X.setHostnameVerifier(...)
+              - pattern-inside: $X.setDefaultHostnameVerifier(...)
       # Apache HttpClient NoopHostnameVerifier (constructor or INSTANCE).
       - pattern: new org.apache.http.conn.ssl.NoopHostnameVerifier()
       - pattern: new NoopHostnameVerifier()

package/rules/java/web/security-ignoring-all.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.web.security-ignoring-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring excludes all paths from the security filter chain.
+
+      `WebSecurity.ignoring()` removes the matched paths from the Spring
+      Security filter chain entirely, so they get no authentication,
+      authorization, CSRF, or header protection at all. Passing the `/**`
+      wildcard excludes every request, leaving the whole application unprotected
+      (CWE-862). This is a common AI-generated shortcut to silence security
+      errors during development that then ships to production.
+
+      Never `ignoring()` a broad wildcard. Limit it to genuinely static,
+      non-sensitive assets, e.g.
+      `web.ignoring().requestMatchers("/css/**", "/js/**")`, or better, handle
+      authorization inside the filter chain with `permitAll()` on scoped paths
+      so the security headers still apply.
+    # Literal `/**` passed to ignoring() across the Security 6 (requestMatchers)
+    # and legacy (antMatchers) APIs. A scoped asset path like "/css/**" does not
+    # match the literal "/**", so static-resource excludes do not fire.
+    pattern-either:
+      - pattern: $WEB.ignoring().requestMatchers("/**")
+      - pattern: $WEB.ignoring().antMatchers("/**")
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-security-ignoring-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/configuration/java.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/java/web/wildcard-permit-all.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.java.web.wildcard-permit-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring permits every request via a catch-all matcher.
+
+      The `/**` matcher matches every path, so granting it `permitAll()` makes
+      the whole application reachable without authentication, including
+      state-changing and sensitive endpoints (CWE-862, broken access control).
+      This is a common AI-generated Spring mistake: a wide-open matcher is
+      pasted in to "make it work" and the intended access rules are never added.
+
+      Open only the specific public routes explicitly, e.g.
+      `requestMatchers("/public/**").permitAll()`, and require authentication by
+      default with `anyRequest().authenticated()`. Granting `permitAll()` on a
+      scoped path is fine; granting it on `/**` is not.
+    # Literal `/**` wildcard granted permitAll across the three matcher APIs
+    # (requestMatchers in Security 6, antMatchers/mvcMatchers in the legacy
+    # chain). Scoped paths like "/public/**" do not match the literal "/**".
+    pattern-either:
+      - pattern: $X.requestMatchers("/**").permitAll()
+      - pattern: $X.antMatchers("/**").permitAll()
+      - pattern: $X.mvcMatchers("/**").permitAll()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-wildcard-permit-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/nextauth/hardcoded-secret.yml

@@ -0,0 +1,62 @@
+rules:
+  - id: auth.nextauth.hardcoded-secret
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      The NextAuth/Auth.js `secret` is set to a hard-coded string literal.
+
+      This value signs and encrypts every session JWT and CSRF token. Committed
+      to git it is one search away from compromise, letting an attacker forge
+      sessions for any user. Read it from the environment instead:
+      `secret: process.env.AUTH_SECRET` (or `NEXTAUTH_SECRET`) and add the
+      variable to `.env.example` with a placeholder.
+    # Anchored to a NextAuth/Auth.js config so a bare `secret:` in unrelated
+    # code never fires: the property must sit inside a `NextAuth(...)` /
+    # `Auth(...)` call, an `authOptions`/`authConfig` object, or an object typed
+    # as `NextAuthOptions` / `NextAuthConfig` / `AuthOptions`. The value is an
+    # AST string literal (`"..."`), so `process.env.*` reads are structurally
+    # excluded; the regex allow-list drops `${ENV}` templates, `<placeholders>`,
+    # and obvious doc/test stubs. `paths.exclude` keeps the rule off test and
+    # example trees (where dev secrets like `"secret"` are intentional), while
+    # still firing on its own fixtures under rules/tests/fixtures/.
+    patterns:
+      - pattern: 'secret: "..."'
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]\$\{?[A-Za-z_]+\}?['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]<[^'"]*>['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|change[-_]?me|redacted|replace)
+      - pattern-either:
+          - pattern-inside: 'NextAuth({...})'
+          - pattern-inside: 'NextAuth($A, {...})'
+          - pattern-inside: 'NextAuth($A, $B, {...})'
+          - pattern-inside: 'Auth($A, {...})'
+          - pattern-inside: 'authOptions = {...}'
+          - pattern-inside: 'authConfig = {...}'
+          - pattern-inside: '$X: NextAuthOptions = {...}'
+          - pattern-inside: '$X: NextAuthConfig = {...}'
+          - pattern-inside: '$X: AuthOptions = {...}'
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+    metadata:
+      oauthlint-rule-id: AUTH-NEXTAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/nextauth-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - next-auth
+      references:
+        - https://authjs.dev/getting-started/deployment#auth_secret
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/oauth/no-state.yml

@@ -14,14 +14,15 @@ rules:
       substitute for `state` when handling browser sessions.
     pattern-either:
       # Inline authorize URL carrying both client_id and response_type but no
-      # state. The path is not hardcoded (Google uses /o/oauth2/v2/auth, etc.).
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*client_id=[^'"]*['"]
-          - pattern-regex: |-
-              response_type=
-          - pattern-not-regex: |-
-              state=
+      # state, evaluated per quoted URL literal (the lookaheads/lookbehind are
+      # bounded to the contents of one string by `[^'"]`). This avoids the
+      # file-level false negative where a `state=` elsewhere in the file (a
+      # comment, a different correct call) would suppress a genuinely
+      # state-less URL. The path is not hardcoded (Google uses
+      # /o/oauth2/v2/auth, etc.). Single/double quotes only — a dynamic
+      # template-literal URL (backticks) is excluded.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]client_id=)(?=[^'"]*[?&]response_type=)(?![^'"]*[?&]state=)[^'"]+['"]
       # Programmatic URLSearchParams build (AST object match — robust to key
       # order and length). Fires when client_id + response_type are present but
       # state is not (covers both `state: x` and the `state` shorthand).

package/rules/oauth/open-redirect-callback.yml

@@ -25,9 +25,24 @@ rules:
       - pattern: '$REQ.query[$K]'
       - pattern: '$REQ.body[$K]'
     pattern-sanitizers:
-      - pattern: '$SET.has(...)'
-      - pattern: '$ARR.includes(...)'
-      - pattern: '$ARR.indexOf(...)'
+      # An inline allow-list membership guard vets the value: a value used inside
+      # `if (set.has(x)) { ... }` / `if (arr.includes(x)) { ... }` /
+      # `if (arr.indexOf(x) ...) { ... }` is treated as validated. The
+      # boolean-returning membership call itself does NOT sanitize its argument
+      # (that would only clear the boolean, not the value), so we clear taint by
+      # the if-guard, mirroring the Python rule's `if is_safe_url(v): ...`.
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $SET.has($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.includes($X) ...>) { ... }
+      - patterns:
+          - pattern: $X
+          - pattern-inside: |
+              if (<... $ARR.indexOf($X) ...>) { ... }
     pattern-sinks:
       - patterns:
           - pattern-either:

package/rules/oauth/static-state.yml

@@ -28,13 +28,14 @@ rules:
               - pattern: 'new URLSearchParams({..., state: "$S", ...})'
               - pattern: "new URLSearchParams({..., state: '$S', ...})"
       # Inline authorize URL string literal carrying both response_type and a
-      # constant state value. A dynamic state would be a template literal
-      # (backticks) with `${...}`, which this single/double-quoted form excludes.
-      - patterns:
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*response_type=[^'"]*['"]
-          - pattern-regex: |-
-              ['"]https?://[^'"\s]+\?[^'"]*state=[A-Za-z0-9._~%-]+[^'"]*['"]
+      # constant state value WITHIN THE SAME quoted literal. Using a single
+      # regex (lookaheads bounded by `[^'"]`) prevents the file-level false
+      # positive where `response_type=` in one string and a constant `state=`
+      # in a different string would otherwise combine into a finding. A dynamic
+      # state would be a template literal (backticks) with `${...}`, which this
+      # single/double-quoted form excludes.
+      - pattern-regex: |-
+          ['"]https?://(?=[^'"]*[?&]response_type=)(?=[^'"]*[?&]state=[A-Za-z0-9._~%-]+)[^'"]+['"]
     metadata:
       oauthlint-rule-id: AUTH-OAUTH-016
       oauthlint-doc-url: https://oauthlint.dev/rules/oauth-static-state

package/rules/passport/jwt-ignore-expiration.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.passport.jwt-ignore-expiration
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A `passport-jwt` strategy is configured with `ignoreExpiration: true`.
+
+      This disables the `exp` claim check, so the strategy authenticates expired
+      tokens forever. A leaked or long-old JWT then never stops working,
+      defeating short-lived access tokens. Remove `ignoreExpiration: true` (the
+      default is `false`, which enforces `exp`) and issue tokens with a short
+      lifetime. See CWE-613 (Insufficient Session Expiration).
+    # Scoped to `passport-jwt` so an unrelated `ignoreExpiration: true` (in some
+    # other library's options) never fires. The file must import the
+    # `passport-jwt` Strategy (named, aliased, default, or via `require`), and
+    # the option must sit inside a `new ...Strategy({...}, ...)` construction.
+    # `new $S({...}, ...)` matches passport-jwt's `(opts, verify)` constructor
+    # for any binding name, so the common `new JwtStrategy({ ... }, verify)`
+    # alias spelling is covered without relying on Semgrep alias resolution. The
+    # match is narrowed to the `ignoreExpiration: true` property itself, so it
+    # is caught regardless of which sibling options appear. Non-overlapping with
+    # auth.jwt.ignore-expiration, which is scoped to `jsonwebtoken`'s
+    # `jwt.verify(...)`.
+    patterns:
+      - pattern-either:
+          - pattern-inside: |
+              import { ..., Strategy, ... } from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              import Strategy from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt')
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt').Strategy
+              ...
+          - pattern-inside: |
+              { ..., Strategy, ... } = require('passport-jwt')
+              ...
+      - pattern-either:
+          - pattern-inside: 'new $S({...}, ...)'
+          - pattern-inside: 'new $S.Strategy({...}, ...)'
+      - pattern: 'ignoreExpiration: true'
+    metadata:
+      oauthlint-rule-id: AUTH-PASSPORT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/passport-jwt-ignore-expiration
+      category: security
+      cwe: CWE-613
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - passport-jwt
+      references:
+        - https://www.passportjs.org/packages/passport-jwt/
+        - https://cwe.mitre.org/data/definitions/613.html

package/rules/py/cookie/insecure-flags.yml

@@ -30,7 +30,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cookie-insecure-flags
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - flask

package/rules/py/cors/allow-all.yml

@@ -46,7 +46,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-allow-all
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - flask-cors

package/rules/py/cors/fastapi-wildcard-credentials.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.py.cors.fastapi-wildcard-credentials
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      FastAPI CORS allows any origin with credentials.
+
+      Starlette's `CORSMiddleware` is configured with a wildcard origin
+      (`allow_origins=["*"]` or `allow_origin_regex=".*"`) together with
+      `allow_credentials=True`. The CORS spec forbids
+      `Access-Control-Allow-Origin: *` alongside
+      `Access-Control-Allow-Credentials: true`, so Starlette silently reflects
+      the caller's `Origin` instead, turning the wildcard into "allow every
+      site" for credentialed requests. Any website can then read authenticated
+      responses, leaking cookies, session and OAuth tokens cross-origin
+      (CWE-942).
+
+      Credentialed CORS needs an explicit allow-list of trusted origins, e.g.
+      `allow_origins=["https://app.example.com"], allow_credentials=True`. If
+      the endpoint is genuinely public, drop credentials:
+      `allow_origins=["*"], allow_credentials=False`.
+    # Require the co-occurrence of a wildcard origin AND credentials on the SAME
+    # CORSMiddleware configuration. The first arm scopes to the `CORSMiddleware`
+    # symbol (either `app.add_middleware(CORSMiddleware, ...)` or a direct
+    # `CORSMiddleware(...)`); the AND-ed arms then demand both
+    # `allow_credentials=True` and a wildcard origin, so argument order does not
+    # matter and an explicit allow-list (or credentials disabled) never fires.
+    patterns:
+      - pattern-either:
+          - pattern: $APP.add_middleware(CORSMiddleware, ...)
+          - pattern: CORSMiddleware(...)
+      - pattern: $F(..., allow_credentials=True, ...)
+      - pattern-either:
+          - pattern: $F(..., allow_origins=["*"], ...)
+          - pattern: $F(..., allow_origin_regex=".*", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-fastapi-wildcard-credentials
+      category: security
+      cwe: CWE-942
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - fastapi
+      references:
+        - https://www.starlette.io/middleware/#corsmiddleware
+        - https://fastapi.tiangolo.com/tutorial/cors/
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/py/crypto/passlib-weak-scheme.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.py.crypto.passlib-weak-scheme
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      passlib configured with a weak or plaintext password scheme.
+
+      A `CryptContext` lists a password hashing scheme that is broken for
+      storing credentials: unsalted or fast digests (`hex_md5`, `hex_sha1`,
+      `hex_sha256`, `md5_crypt`, `ldap_md5`), legacy `des_crypt`, or outright
+      `plaintext` / `ldap_plaintext`. These are trivially brute-forced or
+      reversed, so any leaked hash exposes the underlying password (CWE-916).
+
+      Use a slow, salted, memory-hard scheme as the default, e.g.
+      `CryptContext(schemes=["argon2"])` or
+      `CryptContext(schemes=["bcrypt"])`. Keep a weak scheme only as a
+      `deprecated` verifier during migration, never as an active hashing scheme.
+    # Match the passlib `CryptContext(schemes=[...])` config where any element of
+    # the schemes list is in a CLOSED list of genuinely broken schemes. The
+    # `"$SCHEME"` string-literal metavariable captures each list element's text,
+    # and the anchored metavariable-regex matches ONLY the weak names, so modern
+    # schemes (bcrypt, argon2, scrypt, pbkdf2_sha256, ...) never fire.
+    patterns:
+      - pattern: CryptContext(..., schemes=[..., "$SCHEME", ...], ...)
+      - metavariable-regex:
+          metavariable: $SCHEME
+          regex: ^(md5_crypt|des_crypt|plaintext|hex_md5|hex_sha1|hex_sha256|ldap_md5|ldap_plaintext)$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-CRYPTO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-crypto-passlib-weak-scheme
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - passlib
+      references:
+        - https://passlib.readthedocs.io/en/stable/lib/passlib.context.html
+        - https://cwe.mitre.org/data/definitions/916.html