oauthlint-rules 0.3.1 → 0.5.0

package/rules/py/django/cors-allow-all.yml

@@ -0,0 +1,34 @@
+rules:
+  - id: auth.py.django.cors-allow-all
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      django-cors-headers is configured to allow every origin, disabling
+      cross-origin access control.
+
+      `CORS_ALLOW_ALL_ORIGINS = True` (or the legacy `CORS_ORIGIN_ALLOW_ALL =
+      True`) reflects any site's `Origin`, so ANY website can make cross-origin
+      requests to your API; combined with credentialed sessions this leaks
+      cookies, tokens and CSRF protections cross-origin (CWE-942, OWASP
+      A05:2021). Set it to `False` and list trusted origins explicitly, e.g.
+      `CORS_ALLOWED_ORIGINS = ["https://app.example.com"]`.
+    # Matches ONLY the literal `True` on the django-cors-headers settings keys.
+    # `= False` and an explicit `CORS_ALLOWED_ORIGINS = [...]` allow-list are
+    # never flagged. Distinct from `auth.py.cors.allow-all`, which targets the
+    # Flask-CORS `CORS(...)` / `@cross_origin(...)` call forms.
+    pattern-either:
+      - pattern: CORS_ALLOW_ALL_ORIGINS = True
+      - pattern: CORS_ORIGIN_ALLOW_ALL = True
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DJANGO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-django-cors-allow-all
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - django-cors-headers
+      references:
+        - https://github.com/adamchainz/django-cors-headers#cors_allow_all_origins-bool
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/py/drf/default-authentication-empty.yml

@@ -0,0 +1,32 @@
+rules:
+  - id: auth.py.drf.default-authentication-empty
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      DRF disables authentication globally with an empty
+      `DEFAULT_AUTHENTICATION_CLASSES` list.
+
+      An empty list means no authentication scheme runs, so `request.user` is
+      never populated from a credential and every view falls back to anonymous
+      access (CWE-306, OWASP A01:2021). Permission checks that rely on
+      `request.user` being authenticated then have nothing to enforce against.
+
+      Populate the list with the schemes you use, for example
+      `rest_framework.authentication.SessionAuthentication` and
+      `rest_framework.authentication.TokenAuthentication`.
+    # Scoped to the `REST_FRAMEWORK` settings dict; matches ONLY the empty list.
+    # A populated list such as `[SessionAuthentication]` is not matched.
+    pattern: 'REST_FRAMEWORK = {..., "DEFAULT_AUTHENTICATION_CLASSES": [], ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-default-authentication-empty
+      category: security
+      cwe: CWE-306
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/authentication/#setting-the-authentication-scheme
+        - https://cwe.mitre.org/data/definitions/306.html

package/rules/py/drf/default-permission-allowany.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: auth.py.drf.default-permission-allowany
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      DRF makes every endpoint public because `DEFAULT_PERMISSION_CLASSES` is set
+      to `AllowAny`.
+
+      With `AllowAny` as the project-wide default, every view that does not
+      override `permission_classes` skips authorization entirely, so any
+      unauthenticated caller can reach it (CWE-862, OWASP A01:2021). This is easy
+      to ship by accident because it silently exposes future endpoints too.
+
+      Set the global default to a real permission such as
+      `rest_framework.permissions.IsAuthenticated` and opt specific views out to
+      public only when you mean to.
+    # Scoped to the `REST_FRAMEWORK` settings dict. Matches `AllowAny` both as the
+    # imported symbol and as the `'rest_framework.permissions.AllowAny'` string.
+    # `IsAuthenticated` (or any other class), or the key being absent, is not matched.
+    pattern-either:
+      - pattern: 'REST_FRAMEWORK = {..., "DEFAULT_PERMISSION_CLASSES": [..., AllowAny, ...], ...}'
+      - pattern: 'REST_FRAMEWORK = {..., "DEFAULT_PERMISSION_CLASSES": [..., "rest_framework.permissions.AllowAny", ...], ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-default-permission-allowany
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/permissions/#setting-the-permission-policy
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/py/drf/view-authentication-disabled.yml

@@ -0,0 +1,34 @@
+rules:
+  - id: auth.py.drf.view-authentication-disabled
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A DRF view disables authentication with an empty `authentication_classes`
+      list.
+
+      Setting `authentication_classes = []` on a view (or the
+      `@authentication_classes([])` decorator on a function view) turns off every
+      authentication scheme for that endpoint, so `request.user` is always
+      anonymous and any permission tied to an authenticated user cannot hold
+      (CWE-306, OWASP A01:2021).
+
+      List the schemes the view should accept, for example
+      `authentication_classes = [TokenAuthentication]`, instead of emptying it.
+    # Matches ONLY an explicitly emptied `authentication_classes`, as a class
+    # attribute or via the decorator. A populated list is not matched.
+    pattern-either:
+      - pattern: authentication_classes = []
+      - pattern: "@authentication_classes([])"
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-view-authentication-disabled
+      category: security
+      cwe: CWE-306
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/views/#api_view
+        - https://cwe.mitre.org/data/definitions/306.html

package/rules/py/flask/session-cookie-insecure.yml

@@ -0,0 +1,42 @@
+rules:
+  - id: auth.py.flask.session-cookie-insecure
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A Flask cookie security flag is disabled through `app.config`, weakening
+      session and remember-me cookie protection.
+
+      `SESSION_COOKIE_SECURE = False` lets the session cookie travel over plain
+      HTTP where it can be sniffed on the wire, and `SESSION_COOKIE_HTTPONLY =
+      False` exposes it to JavaScript so an XSS payload can read and exfiltrate
+      it; the `REMEMBER_COOKIE_*` flags do the same for Flask-Login's long-lived
+      remember-me token (CWE-614, OWASP A05:2021). Keep these `True` (or drive
+      them from an environment check), e.g. `app.config["SESSION_COOKIE_SECURE"]
+      = True` and `app.config["SESSION_COOKIE_HTTPONLY"] = True`.
+    # Matches ONLY the literal `False` set via `app.config[...] = False` (the
+    # subscript form) or `app.config.update(...=False)` (the keyword form) — the
+    # `app.config` variants that the bare module-level assignment rule
+    # `auth.py.cookie.insecure-flags` does NOT see. `= True` and env-driven
+    # values are never flagged. `$APP` matches any Flask app variable name.
+    pattern-either:
+      - pattern: $APP.config['SESSION_COOKIE_SECURE'] = False
+      - pattern: $APP.config['SESSION_COOKIE_HTTPONLY'] = False
+      - pattern: $APP.config['REMEMBER_COOKIE_SECURE'] = False
+      - pattern: $APP.config['REMEMBER_COOKIE_HTTPONLY'] = False
+      - pattern: $APP.config.update(..., SESSION_COOKIE_SECURE=False, ...)
+      - pattern: $APP.config.update(..., REMEMBER_COOKIE_SECURE=False, ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLASK-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flask-session-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - flask
+        - flask-login
+      references:
+        - https://flask.palletsprojects.com/en/stable/config/#SESSION_COOKIE_SECURE
+        - https://flask-login.readthedocs.io/en/latest/#cookie-settings
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/py/flow/requests-verify-disabled.yml

@@ -19,29 +19,41 @@ rules:
     # Scoped to `requests.<method>(...)`, `requests.request(...)` and Session
     # objects (`$SESSION.<method>(...)`). Fires only on the literal
     # `verify=False`; `verify=True` and `verify="/path/ca.pem"` are not flagged.
-    pattern-either:
-      - pattern: requests.get(..., verify=False, ...)
-      - pattern: requests.post(..., verify=False, ...)
-      - pattern: requests.put(..., verify=False, ...)
-      - pattern: requests.delete(..., verify=False, ...)
-      - pattern: requests.patch(..., verify=False, ...)
-      - pattern: requests.head(..., verify=False, ...)
-      - pattern: requests.options(..., verify=False, ...)
-      - pattern: requests.request(..., verify=False, ...)
-      - pattern: $SESSION.get(..., verify=False, ...)
-      - pattern: $SESSION.post(..., verify=False, ...)
-      - pattern: $SESSION.put(..., verify=False, ...)
-      - pattern: $SESSION.delete(..., verify=False, ...)
-      - pattern: $SESSION.patch(..., verify=False, ...)
-      - pattern: $SESSION.head(..., verify=False, ...)
-      - pattern: $SESSION.options(..., verify=False, ...)
-      - pattern: $SESSION.request(..., verify=False, ...)
+    patterns:
+      - pattern-either:
+          - pattern: requests.get(..., verify=$V, ...)
+          - pattern: requests.post(..., verify=$V, ...)
+          - pattern: requests.put(..., verify=$V, ...)
+          - pattern: requests.delete(..., verify=$V, ...)
+          - pattern: requests.patch(..., verify=$V, ...)
+          - pattern: requests.head(..., verify=$V, ...)
+          - pattern: requests.options(..., verify=$V, ...)
+          - pattern: requests.request(..., verify=$V, ...)
+          - pattern: $SESSION.get(..., verify=$V, ...)
+          - pattern: $SESSION.post(..., verify=$V, ...)
+          - pattern: $SESSION.put(..., verify=$V, ...)
+          - pattern: $SESSION.delete(..., verify=$V, ...)
+          - pattern: $SESSION.patch(..., verify=$V, ...)
+          - pattern: $SESSION.head(..., verify=$V, ...)
+          - pattern: $SESSION.options(..., verify=$V, ...)
+          - pattern: $SESSION.request(..., verify=$V, ...)
+      # Fire only on the literal `False` (unchanged detection), and focus the
+      # match/fix on that value token so the autofix flips just it, leaving the
+      # rest of the call intact.
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^False$
+      - focus-metavariable: $V
+    # Safe, deterministic autofix: `True` is the library default (verification
+    # on) and the exact value the rule treats as compliant, so it fully resolves
+    # the finding. Only the value token is rewritten (`verify=False` -> `verify=True`).
+    fix: "True"
     metadata:
       oauthlint-rule-id: AUTH-PY-FLOW-002
       oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-requests-verify-disabled
       category: security
       cwe: CWE-295
-      owasp: API8:2023
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - requests

package/rules/py/jwt/verify-claims-disabled.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.py.jwt.verify-claims-disabled
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      PyJWT decode disables audience or issuer checks.
+
+      `jwt.decode(...)` is called with an `options` dict that turns off a claim
+      check: `"verify_aud": False`, `"verify_iss": False`, or
+      `"verify_nbf": False`. Skipping these lets a token minted for a different
+      audience or issuer (for example one from another tenant or a lower-trust
+      service) be accepted here, defeating the boundary those claims are meant
+      to enforce (CWE-347).
+
+      Remove the disabling option and validate the claim, e.g.
+      `jwt.decode(token, key, algorithms=["RS256"], audience="api",
+      issuer="https://issuer.example.com")`. PyJWT only checks `aud`/`iss` when
+      you pass the expected value, so supply it rather than disabling the check.
+    # Scoped to PyJWT's decode `options` dict. We match ONLY the aud/iss/nbf
+    # keys; `verify_signature` is reported by auth.py.jwt.no-verify and
+    # `verify_exp` by auth.py.jwt.no-expiration, so neither is matched here and
+    # we avoid duplicate findings.
+    patterns:
+      - pattern-either:
+          - pattern: jwt.decode(..., options=$OPTS, ...)
+          - pattern: decode(..., options=$OPTS, ...)
+      - metavariable-pattern:
+          metavariable: $OPTS
+          pattern-either:
+            - pattern: '{..., "verify_aud": False, ...}'
+            - pattern: '{..., "verify_iss": False, ...}'
+            - pattern: '{..., "verify_nbf": False, ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-verify-claims-disabled
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/py/oauth/token-request-verify-disabled.yml

@@ -21,10 +21,20 @@ rules:
     # `verify="/path/ca.pem"` are not flagged. This is distinct from
     # auth.py.flow.requests-verify-disabled, which covers the `requests` HTTP
     # verbs (`get`/`post`/…); here the sink is the OAuth token-exchange call.
-    pattern-either:
-      - pattern: $C.fetch_token(..., verify=False, ...)
-      - pattern: $C.refresh_token(..., verify=False, ...)
-      - pattern: $C.fetch_access_token(..., verify=False, ...)
+    patterns:
+      - pattern-either:
+          - pattern: $C.fetch_token(..., verify=$V, ...)
+          - pattern: $C.refresh_token(..., verify=$V, ...)
+          - pattern: $C.fetch_access_token(..., verify=$V, ...)
+      # Fire only on the literal `False` (unchanged detection), and focus the
+      # match/fix on that value token so the autofix flips just it.
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^False$
+      - focus-metavariable: $V
+    # Safe, deterministic autofix: `True` is the default (verification on) and the
+    # exact value the rule treats as compliant, so it resolves the finding.
+    fix: "True"
     metadata:
       oauthlint-rule-id: AUTH-PY-OAUTH-005
       oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-token-request-verify-disabled

package/rules/rust/cookie/insecure.yml

@@ -26,7 +26,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cookie-insecure
       category: security
       cwe: CWE-614
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: HIGH
       technology:
         - cookie

package/rules/rust/cors/permissive.yml

@@ -27,7 +27,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/rust-cors-permissive
       category: security
       cwe: CWE-942
-      owasp: A05:2021
+      owasp: API8:2023
       llm-prevalence: MEDIUM
       technology:
         - actix-web

package/rules/rust/flow/ssrf.yml

@@ -0,0 +1,90 @@
+rules:
+  - id: auth.rust.flow.ssrf
+    languages:
+      - rust
+    severity: ERROR
+    message: |
+      Untrusted request input flows into the URL of an outbound HTTP request.
+      Because the destination is attacker-controlled, this is a Server-Side
+      Request Forgery (CWE-918): an attacker can point the request at internal
+      services behind your firewall, or at the cloud metadata endpoint
+      (http://169.254.169.254/...) to steal IAM/instance credentials and pivot
+      deeper into your infrastructure.
+
+      Never pass a request-derived `String` (an axum/actix handler parameter, or
+      a value taken from request input) straight into `reqwest::get(...)` or a
+      `Client::get(...)` / `Client::post(...).send()`. Validate the destination
+      host against an explicit allow-list (parse the URL and check the resolved
+      host/scheme, rejecting private/loopback/link-local ranges) before issuing
+      the request.
+    # Taint mode so indirection (let u = params.url; reqwest::get(u)) is caught,
+    # not just the inline form. The source is narrowed to function PARAMETERS
+    # (the shape an axum/actix handler takes its request data in) so an
+    # arbitrary local `let url = "https://constant"` is not treated as untrusted
+    # — only data arriving as a handler/function parameter is. The taint is
+    # cleared by an allow-list / host-validation if-guard, mirroring the Python
+    # and Go SSRF rules.
+    mode: taint
+    pattern-sources:
+      # A function parameter carrying request data: a bare `String` (the typical
+      # axum `String` / extracted field), or an axum `Query`/`Path` extractor
+      # (both the type-position and the destructured forms). Focus the parameter
+      # so the taint tracks the value rather than the whole function.
+      - patterns:
+          - pattern-either:
+              - pattern: "fn $F(..., $P: String, ...) {...}"
+              - pattern: "fn $F(..., $P: Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., $P: Path<$T>, ...) {...}"
+              - pattern: "fn $F(..., Query($P): Query<$T>, ...) {...}"
+              - pattern: "fn $F(..., Path($P): Path<$T>, ...) {...}"
+          - focus-metavariable: $P
+    pattern-sanitizers:
+      # A value used inside an allow-list / host-validation if-guard is treated
+      # as vetted, so the guarded request does not fire. A bare `Url::parse(...)`
+      # is deliberately NOT a sanitizer: the parsed URL is still
+      # attacker-controlled, so parse-then-use without a host check must fire.
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if is_allowed_url(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if validate_host(<... $V ...>) {
+                  ...
+              }
+      - patterns:
+          - pattern: $V
+          - pattern-inside: |
+              if $ALLOW.contains(<... $V ...>) {
+                  ...
+              }
+    pattern-sinks:
+      # Focus the URL argument so the finding lands on the tainted destination.
+      - patterns:
+          - pattern-either:
+              - pattern: reqwest::get($URL)
+              - pattern: reqwest::blocking::get($URL)
+              - pattern: $C.get($URL).send()
+              - pattern: $C.post($URL).send()
+              - pattern: $C.put($URL).send()
+              - pattern: $C.delete($URL).send()
+              - pattern: $C.head($URL).send()
+              - pattern: $C.request($M, $URL).send()
+          - focus-metavariable: $URL
+    metadata:
+      oauthlint-rule-id: AUTH-RUST-FLOW-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/rust-flow-ssrf
+      category: security
+      cwe: CWE-918
+      owasp: API7:2023
+      llm-prevalence: HIGH
+      technology:
+        - reqwest
+        - axum
+        - actix-web
+      references:
+        - https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
+        - https://cwe.mitre.org/data/definitions/918.html

package/rules/tls/reject-unauthorized.yml

@@ -31,7 +31,7 @@ rules:
       oauthlint-doc-url: https://oauthlint.dev/rules/tls-reject-unauthorized
       category: security
       cwe: CWE-295
-      owasp: A05:2021
+      owasp: A02:2021
       llm-prevalence: HIGH
       technology:
         - node