oauthlint-rules 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oauthlint-rules",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Semgrep rules catching the OAuth/OIDC/JWT anti-patterns that AI coding tools systematically produce.",
   "type": "module",
   "main": "./dist/index.js",

package/rules/express/cookie-insecure.yml

@@ -0,0 +1,44 @@
+rules:
+  - id: auth.express.cookie-insecure
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      An Express session cookie is explicitly configured as insecure. Setting
+      `secure: false` lets the browser send the session cookie over plain HTTP,
+      and `httpOnly: false` exposes it to `document.cookie` (any XSS reads it).
+
+      Either drop the flag (the framework default may still need hardening) or
+      set `secure: true` and `httpOnly: true` for production. If you need
+      insecure cookies in dev, gate the value on `NODE_ENV !== 'production'`
+      rather than hard-coding `false`.
+    # Targets the session-middleware config object only, never `res.cookie(...)`
+    # (that shape is covered by the auth.cookie.* rules). We match ONLY an
+    # explicit `secure: false` / `httpOnly: false`; a MISSING key is left alone
+    # because express-session already defaults `secure` to false and dev setups
+    # legitimately omit it, so a missing key is undecidable prod-vs-dev and would
+    # be false-positive prone.
+    pattern-either:
+      # express-session: the flags live on a nested `cookie:` object.
+      - pattern: 'session({..., cookie: {..., secure: false, ...}, ...})'
+      - pattern: 'session({..., cookie: {..., httpOnly: false, ...}, ...})'
+      - pattern: 'expressSession({..., cookie: {..., secure: false, ...}, ...})'
+      - pattern: 'expressSession({..., cookie: {..., httpOnly: false, ...}, ...})'
+      # cookie-session: the flags live directly on the options object.
+      - pattern: 'cookieSession({..., secure: false, ...})'
+      - pattern: 'cookieSession({..., httpOnly: false, ...})'
+    metadata:
+      oauthlint-rule-id: AUTH-EXPRESS-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/express-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - express-session
+        - cookie-session
+      references:
+        - https://github.com/expressjs/session#cookiesecure
+        - https://github.com/expressjs/cookie-session#options
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/java/crypto/noop-password-encoder.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.crypto.noop-password-encoder
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring stores passwords with no hashing.
+
+      `NoOpPasswordEncoder` keeps passwords in plaintext and
+      `withDefaultPasswordEncoder()` is a builder helper that Spring explicitly
+      marks for non-production use only. Either way the stored credential is not
+      hashed, so anyone who reads the database or a backup recovers every
+      password directly (CWE-256). This is a common AI-generated shortcut: the
+      no-op encoder is pasted in to "get login working" and never replaced.
+
+      Hash passwords with a dedicated, slow, salted algorithm. Use
+      `new BCryptPasswordEncoder()`, `Argon2PasswordEncoder`, or
+      `Pbkdf2PasswordEncoder` instead. A `DelegatingPasswordEncoder` built via
+      `PasswordEncoderFactories.createDelegatingPasswordEncoder()` is the
+      recommended default.
+    # Two literal sinks: the singleton no-op encoder and the deprecated
+    # User.withDefaultPasswordEncoder() builder helper. Both are tight enough
+    # that a match is always a real plaintext-password configuration.
+    pattern-either:
+      - pattern: NoOpPasswordEncoder.getInstance()
+      - pattern: $U.withDefaultPasswordEncoder()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-CRYPTO-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-crypto-noop-password-encoder
+      category: security
+      cwe: CWE-256
+      owasp: A02:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html
+        - https://cwe.mitre.org/data/definitions/256.html

package/rules/java/web/security-ignoring-all.yml

@@ -0,0 +1,38 @@
+rules:
+  - id: auth.java.web.security-ignoring-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring excludes all paths from the security filter chain.
+
+      `WebSecurity.ignoring()` removes the matched paths from the Spring
+      Security filter chain entirely, so they get no authentication,
+      authorization, CSRF, or header protection at all. Passing the `/**`
+      wildcard excludes every request, leaving the whole application unprotected
+      (CWE-862). This is a common AI-generated shortcut to silence security
+      errors during development that then ships to production.
+
+      Never `ignoring()` a broad wildcard. Limit it to genuinely static,
+      non-sensitive assets, e.g.
+      `web.ignoring().requestMatchers("/css/**", "/js/**")`, or better, handle
+      authorization inside the filter chain with `permitAll()` on scoped paths
+      so the security headers still apply.
+    # Literal `/**` passed to ignoring() across the Security 6 (requestMatchers)
+    # and legacy (antMatchers) APIs. A scoped asset path like "/css/**" does not
+    # match the literal "/**", so static-resource excludes do not fire.
+    pattern-either:
+      - pattern: $WEB.ignoring().requestMatchers("/**")
+      - pattern: $WEB.ignoring().antMatchers("/**")
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-006
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-security-ignoring-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/configuration/java.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/java/web/wildcard-permit-all.yml

@@ -0,0 +1,37 @@
+rules:
+  - id: auth.java.web.wildcard-permit-all
+    languages:
+      - java
+    severity: ERROR
+    message: |
+      Spring permits every request via a catch-all matcher.
+
+      The `/**` matcher matches every path, so granting it `permitAll()` makes
+      the whole application reachable without authentication, including
+      state-changing and sensitive endpoints (CWE-862, broken access control).
+      This is a common AI-generated Spring mistake: a wide-open matcher is
+      pasted in to "make it work" and the intended access rules are never added.
+
+      Open only the specific public routes explicitly, e.g.
+      `requestMatchers("/public/**").permitAll()`, and require authentication by
+      default with `anyRequest().authenticated()`. Granting `permitAll()` on a
+      scoped path is fine; granting it on `/**` is not.
+    # Literal `/**` wildcard granted permitAll across the three matcher APIs
+    # (requestMatchers in Security 6, antMatchers/mvcMatchers in the legacy
+    # chain). Scoped paths like "/public/**" do not match the literal "/**".
+    pattern-either:
+      - pattern: $X.requestMatchers("/**").permitAll()
+      - pattern: $X.antMatchers("/**").permitAll()
+      - pattern: $X.mvcMatchers("/**").permitAll()
+    metadata:
+      oauthlint-rule-id: AUTH-JAVA-WEB-005
+      oauthlint-doc-url: https://oauthlint.dev/rules/java-web-wildcard-permit-all
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - spring-security
+      references:
+        - https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/nextauth/hardcoded-secret.yml

@@ -0,0 +1,62 @@
+rules:
+  - id: auth.nextauth.hardcoded-secret
+    languages:
+      - javascript
+      - typescript
+    severity: ERROR
+    message: |
+      The NextAuth/Auth.js `secret` is set to a hard-coded string literal.
+
+      This value signs and encrypts every session JWT and CSRF token. Committed
+      to git it is one search away from compromise, letting an attacker forge
+      sessions for any user. Read it from the environment instead:
+      `secret: process.env.AUTH_SECRET` (or `NEXTAUTH_SECRET`) and add the
+      variable to `.env.example` with a placeholder.
+    # Anchored to a NextAuth/Auth.js config so a bare `secret:` in unrelated
+    # code never fires: the property must sit inside a `NextAuth(...)` /
+    # `Auth(...)` call, an `authOptions`/`authConfig` object, or an object typed
+    # as `NextAuthOptions` / `NextAuthConfig` / `AuthOptions`. The value is an
+    # AST string literal (`"..."`), so `process.env.*` reads are structurally
+    # excluded; the regex allow-list drops `${ENV}` templates, `<placeholders>`,
+    # and obvious doc/test stubs. `paths.exclude` keeps the rule off test and
+    # example trees (where dev secrets like `"secret"` are intentional), while
+    # still firing on its own fixtures under rules/tests/fixtures/.
+    patterns:
+      - pattern: 'secret: "..."'
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]\$\{?[A-Za-z_]+\}?['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"]<[^'"]*>['"]
+      - pattern-not-regex: |-
+          (?i)secret\s*:\s*['"](?:your[-_]|my[-_]|example|placeholder|xxx+|todo|fixme|test|dummy|fake|sample|changeme|change[-_]?me|redacted|replace)
+      - pattern-either:
+          - pattern-inside: 'NextAuth({...})'
+          - pattern-inside: 'NextAuth($A, {...})'
+          - pattern-inside: 'NextAuth($A, $B, {...})'
+          - pattern-inside: 'Auth($A, {...})'
+          - pattern-inside: 'authOptions = {...}'
+          - pattern-inside: 'authConfig = {...}'
+          - pattern-inside: '$X: NextAuthOptions = {...}'
+          - pattern-inside: '$X: NextAuthConfig = {...}'
+          - pattern-inside: '$X: AuthOptions = {...}'
+    paths:
+      exclude:
+        - "**/test/**"
+        - "**/__tests__/**"
+        - "**/*.test.*"
+        - "**/*.spec.*"
+        - "**/example/**"
+        - "**/examples/**"
+        - "**/demo/**"
+    metadata:
+      oauthlint-rule-id: AUTH-NEXTAUTH-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/nextauth-hardcoded-secret
+      category: security
+      cwe: CWE-798
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - next-auth
+      references:
+        - https://authjs.dev/getting-started/deployment#auth_secret
+        - https://cwe.mitre.org/data/definitions/798.html

package/rules/passport/jwt-ignore-expiration.yml

@@ -0,0 +1,58 @@
+rules:
+  - id: auth.passport.jwt-ignore-expiration
+    languages:
+      - javascript
+      - typescript
+    severity: WARNING
+    message: |
+      A `passport-jwt` strategy is configured with `ignoreExpiration: true`.
+
+      This disables the `exp` claim check, so the strategy authenticates expired
+      tokens forever. A leaked or long-old JWT then never stops working,
+      defeating short-lived access tokens. Remove `ignoreExpiration: true` (the
+      default is `false`, which enforces `exp`) and issue tokens with a short
+      lifetime. See CWE-613 (Insufficient Session Expiration).
+    # Scoped to `passport-jwt` so an unrelated `ignoreExpiration: true` (in some
+    # other library's options) never fires. The file must import the
+    # `passport-jwt` Strategy (named, aliased, default, or via `require`), and
+    # the option must sit inside a `new ...Strategy({...}, ...)` construction.
+    # `new $S({...}, ...)` matches passport-jwt's `(opts, verify)` constructor
+    # for any binding name, so the common `new JwtStrategy({ ... }, verify)`
+    # alias spelling is covered without relying on Semgrep alias resolution. The
+    # match is narrowed to the `ignoreExpiration: true` property itself, so it
+    # is caught regardless of which sibling options appear. Non-overlapping with
+    # auth.jwt.ignore-expiration, which is scoped to `jsonwebtoken`'s
+    # `jwt.verify(...)`.
+    patterns:
+      - pattern-either:
+          - pattern-inside: |
+              import { ..., Strategy, ... } from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              import Strategy from 'passport-jwt'
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt')
+              ...
+          - pattern-inside: |
+              $S = require('passport-jwt').Strategy
+              ...
+          - pattern-inside: |
+              { ..., Strategy, ... } = require('passport-jwt')
+              ...
+      - pattern-either:
+          - pattern-inside: 'new $S({...}, ...)'
+          - pattern-inside: 'new $S.Strategy({...}, ...)'
+      - pattern: 'ignoreExpiration: true'
+    metadata:
+      oauthlint-rule-id: AUTH-PASSPORT-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/passport-jwt-ignore-expiration
+      category: security
+      cwe: CWE-613
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - passport-jwt
+      references:
+        - https://www.passportjs.org/packages/passport-jwt/
+        - https://cwe.mitre.org/data/definitions/613.html

package/rules/py/cors/fastapi-wildcard-credentials.yml

@@ -0,0 +1,49 @@
+rules:
+  - id: auth.py.cors.fastapi-wildcard-credentials
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      FastAPI CORS allows any origin with credentials.
+
+      Starlette's `CORSMiddleware` is configured with a wildcard origin
+      (`allow_origins=["*"]` or `allow_origin_regex=".*"`) together with
+      `allow_credentials=True`. The CORS spec forbids
+      `Access-Control-Allow-Origin: *` alongside
+      `Access-Control-Allow-Credentials: true`, so Starlette silently reflects
+      the caller's `Origin` instead, turning the wildcard into "allow every
+      site" for credentialed requests. Any website can then read authenticated
+      responses, leaking cookies, session and OAuth tokens cross-origin
+      (CWE-942).
+
+      Credentialed CORS needs an explicit allow-list of trusted origins, e.g.
+      `allow_origins=["https://app.example.com"], allow_credentials=True`. If
+      the endpoint is genuinely public, drop credentials:
+      `allow_origins=["*"], allow_credentials=False`.
+    # Require the co-occurrence of a wildcard origin AND credentials on the SAME
+    # CORSMiddleware configuration. The first arm scopes to the `CORSMiddleware`
+    # symbol (either `app.add_middleware(CORSMiddleware, ...)` or a direct
+    # `CORSMiddleware(...)`); the AND-ed arms then demand both
+    # `allow_credentials=True` and a wildcard origin, so argument order does not
+    # matter and an explicit allow-list (or credentials disabled) never fires.
+    patterns:
+      - pattern-either:
+          - pattern: $APP.add_middleware(CORSMiddleware, ...)
+          - pattern: CORSMiddleware(...)
+      - pattern: $F(..., allow_credentials=True, ...)
+      - pattern-either:
+          - pattern: $F(..., allow_origins=["*"], ...)
+          - pattern: $F(..., allow_origin_regex=".*", ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-CORS-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-fastapi-wildcard-credentials
+      category: security
+      cwe: CWE-942
+      owasp: API8:2023
+      llm-prevalence: HIGH
+      technology:
+        - fastapi
+      references:
+        - https://www.starlette.io/middleware/#corsmiddleware
+        - https://fastapi.tiangolo.com/tutorial/cors/
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/py/crypto/passlib-weak-scheme.yml

@@ -0,0 +1,40 @@
+rules:
+  - id: auth.py.crypto.passlib-weak-scheme
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      passlib configured with a weak or plaintext password scheme.
+
+      A `CryptContext` lists a password hashing scheme that is broken for
+      storing credentials: unsalted or fast digests (`hex_md5`, `hex_sha1`,
+      `hex_sha256`, `md5_crypt`, `ldap_md5`), legacy `des_crypt`, or outright
+      `plaintext` / `ldap_plaintext`. These are trivially brute-forced or
+      reversed, so any leaked hash exposes the underlying password (CWE-916).
+
+      Use a slow, salted, memory-hard scheme as the default, e.g.
+      `CryptContext(schemes=["argon2"])` or
+      `CryptContext(schemes=["bcrypt"])`. Keep a weak scheme only as a
+      `deprecated` verifier during migration, never as an active hashing scheme.
+    # Match the passlib `CryptContext(schemes=[...])` config where any element of
+    # the schemes list is in a CLOSED list of genuinely broken schemes. The
+    # `"$SCHEME"` string-literal metavariable captures each list element's text,
+    # and the anchored metavariable-regex matches ONLY the weak names, so modern
+    # schemes (bcrypt, argon2, scrypt, pbkdf2_sha256, ...) never fire.
+    patterns:
+      - pattern: CryptContext(..., schemes=[..., "$SCHEME", ...], ...)
+      - metavariable-regex:
+          metavariable: $SCHEME
+          regex: ^(md5_crypt|des_crypt|plaintext|hex_md5|hex_sha1|hex_sha256|ldap_md5|ldap_plaintext)$
+    metadata:
+      oauthlint-rule-id: AUTH-PY-CRYPTO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-crypto-passlib-weak-scheme
+      category: security
+      cwe: CWE-916
+      owasp: A02:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - passlib
+      references:
+        - https://passlib.readthedocs.io/en/stable/lib/passlib.context.html
+        - https://cwe.mitre.org/data/definitions/916.html

package/rules/py/django/cors-allow-all.yml

@@ -0,0 +1,34 @@
+rules:
+  - id: auth.py.django.cors-allow-all
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      django-cors-headers is configured to allow every origin, disabling
+      cross-origin access control.
+
+      `CORS_ALLOW_ALL_ORIGINS = True` (or the legacy `CORS_ORIGIN_ALLOW_ALL =
+      True`) reflects any site's `Origin`, so ANY website can make cross-origin
+      requests to your API; combined with credentialed sessions this leaks
+      cookies, tokens and CSRF protections cross-origin (CWE-942, OWASP
+      A05:2021). Set it to `False` and list trusted origins explicitly, e.g.
+      `CORS_ALLOWED_ORIGINS = ["https://app.example.com"]`.
+    # Matches ONLY the literal `True` on the django-cors-headers settings keys.
+    # `= False` and an explicit `CORS_ALLOWED_ORIGINS = [...]` allow-list are
+    # never flagged. Distinct from `auth.py.cors.allow-all`, which targets the
+    # Flask-CORS `CORS(...)` / `@cross_origin(...)` call forms.
+    pattern-either:
+      - pattern: CORS_ALLOW_ALL_ORIGINS = True
+      - pattern: CORS_ORIGIN_ALLOW_ALL = True
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DJANGO-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-django-cors-allow-all
+      category: security
+      cwe: CWE-942
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - django-cors-headers
+      references:
+        - https://github.com/adamchainz/django-cors-headers#cors_allow_all_origins-bool
+        - https://cwe.mitre.org/data/definitions/942.html

package/rules/py/drf/default-authentication-empty.yml

@@ -0,0 +1,32 @@
+rules:
+  - id: auth.py.drf.default-authentication-empty
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      DRF disables authentication globally with an empty
+      `DEFAULT_AUTHENTICATION_CLASSES` list.
+
+      An empty list means no authentication scheme runs, so `request.user` is
+      never populated from a credential and every view falls back to anonymous
+      access (CWE-306, OWASP A01:2021). Permission checks that rely on
+      `request.user` being authenticated then have nothing to enforce against.
+
+      Populate the list with the schemes you use, for example
+      `rest_framework.authentication.SessionAuthentication` and
+      `rest_framework.authentication.TokenAuthentication`.
+    # Scoped to the `REST_FRAMEWORK` settings dict; matches ONLY the empty list.
+    # A populated list such as `[SessionAuthentication]` is not matched.
+    pattern: 'REST_FRAMEWORK = {..., "DEFAULT_AUTHENTICATION_CLASSES": [], ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-002
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-default-authentication-empty
+      category: security
+      cwe: CWE-306
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/authentication/#setting-the-authentication-scheme
+        - https://cwe.mitre.org/data/definitions/306.html

package/rules/py/drf/default-permission-allowany.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: auth.py.drf.default-permission-allowany
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      DRF makes every endpoint public because `DEFAULT_PERMISSION_CLASSES` is set
+      to `AllowAny`.
+
+      With `AllowAny` as the project-wide default, every view that does not
+      override `permission_classes` skips authorization entirely, so any
+      unauthenticated caller can reach it (CWE-862, OWASP A01:2021). This is easy
+      to ship by accident because it silently exposes future endpoints too.
+
+      Set the global default to a real permission such as
+      `rest_framework.permissions.IsAuthenticated` and opt specific views out to
+      public only when you mean to.
+    # Scoped to the `REST_FRAMEWORK` settings dict. Matches `AllowAny` both as the
+    # imported symbol and as the `'rest_framework.permissions.AllowAny'` string.
+    # `IsAuthenticated` (or any other class), or the key being absent, is not matched.
+    pattern-either:
+      - pattern: 'REST_FRAMEWORK = {..., "DEFAULT_PERMISSION_CLASSES": [..., AllowAny, ...], ...}'
+      - pattern: 'REST_FRAMEWORK = {..., "DEFAULT_PERMISSION_CLASSES": [..., "rest_framework.permissions.AllowAny", ...], ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-default-permission-allowany
+      category: security
+      cwe: CWE-862
+      owasp: A01:2021
+      llm-prevalence: HIGH
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/permissions/#setting-the-permission-policy
+        - https://cwe.mitre.org/data/definitions/862.html

package/rules/py/drf/view-authentication-disabled.yml

@@ -0,0 +1,34 @@
+rules:
+  - id: auth.py.drf.view-authentication-disabled
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A DRF view disables authentication with an empty `authentication_classes`
+      list.
+
+      Setting `authentication_classes = []` on a view (or the
+      `@authentication_classes([])` decorator on a function view) turns off every
+      authentication scheme for that endpoint, so `request.user` is always
+      anonymous and any permission tied to an authenticated user cannot hold
+      (CWE-306, OWASP A01:2021).
+
+      List the schemes the view should accept, for example
+      `authentication_classes = [TokenAuthentication]`, instead of emptying it.
+    # Matches ONLY an explicitly emptied `authentication_classes`, as a class
+    # attribute or via the decorator. A populated list is not matched.
+    pattern-either:
+      - pattern: authentication_classes = []
+      - pattern: "@authentication_classes([])"
+    metadata:
+      oauthlint-rule-id: AUTH-PY-DRF-003
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-drf-view-authentication-disabled
+      category: security
+      cwe: CWE-306
+      owasp: A01:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - djangorestframework
+      references:
+        - https://www.django-rest-framework.org/api-guide/views/#api_view
+        - https://cwe.mitre.org/data/definitions/306.html

package/rules/py/flask/session-cookie-insecure.yml

@@ -0,0 +1,42 @@
+rules:
+  - id: auth.py.flask.session-cookie-insecure
+    languages:
+      - python
+    severity: ERROR
+    message: |
+      A Flask cookie security flag is disabled through `app.config`, weakening
+      session and remember-me cookie protection.
+
+      `SESSION_COOKIE_SECURE = False` lets the session cookie travel over plain
+      HTTP where it can be sniffed on the wire, and `SESSION_COOKIE_HTTPONLY =
+      False` exposes it to JavaScript so an XSS payload can read and exfiltrate
+      it; the `REMEMBER_COOKIE_*` flags do the same for Flask-Login's long-lived
+      remember-me token (CWE-614, OWASP A05:2021). Keep these `True` (or drive
+      them from an environment check), e.g. `app.config["SESSION_COOKIE_SECURE"]
+      = True` and `app.config["SESSION_COOKIE_HTTPONLY"] = True`.
+    # Matches ONLY the literal `False` set via `app.config[...] = False` (the
+    # subscript form) or `app.config.update(...=False)` (the keyword form) — the
+    # `app.config` variants that the bare module-level assignment rule
+    # `auth.py.cookie.insecure-flags` does NOT see. `= True` and env-driven
+    # values are never flagged. `$APP` matches any Flask app variable name.
+    pattern-either:
+      - pattern: $APP.config['SESSION_COOKIE_SECURE'] = False
+      - pattern: $APP.config['SESSION_COOKIE_HTTPONLY'] = False
+      - pattern: $APP.config['REMEMBER_COOKIE_SECURE'] = False
+      - pattern: $APP.config['REMEMBER_COOKIE_HTTPONLY'] = False
+      - pattern: $APP.config.update(..., SESSION_COOKIE_SECURE=False, ...)
+      - pattern: $APP.config.update(..., REMEMBER_COOKIE_SECURE=False, ...)
+    metadata:
+      oauthlint-rule-id: AUTH-PY-FLASK-001
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-flask-session-cookie-insecure
+      category: security
+      cwe: CWE-614
+      owasp: A05:2021
+      llm-prevalence: MEDIUM
+      technology:
+        - flask
+        - flask-login
+      references:
+        - https://flask.palletsprojects.com/en/stable/config/#SESSION_COOKIE_SECURE
+        - https://flask-login.readthedocs.io/en/latest/#cookie-settings
+        - https://cwe.mitre.org/data/definitions/614.html

package/rules/py/flow/requests-verify-disabled.yml

@@ -19,23 +19,35 @@ rules:
     # Scoped to `requests.<method>(...)`, `requests.request(...)` and Session
     # objects (`$SESSION.<method>(...)`). Fires only on the literal
     # `verify=False`; `verify=True` and `verify="/path/ca.pem"` are not flagged.
-    pattern-either:
-      - pattern: requests.get(..., verify=False, ...)
-      - pattern: requests.post(..., verify=False, ...)
-      - pattern: requests.put(..., verify=False, ...)
-      - pattern: requests.delete(..., verify=False, ...)
-      - pattern: requests.patch(..., verify=False, ...)
-      - pattern: requests.head(..., verify=False, ...)
-      - pattern: requests.options(..., verify=False, ...)
-      - pattern: requests.request(..., verify=False, ...)
-      - pattern: $SESSION.get(..., verify=False, ...)
-      - pattern: $SESSION.post(..., verify=False, ...)
-      - pattern: $SESSION.put(..., verify=False, ...)
-      - pattern: $SESSION.delete(..., verify=False, ...)
-      - pattern: $SESSION.patch(..., verify=False, ...)
-      - pattern: $SESSION.head(..., verify=False, ...)
-      - pattern: $SESSION.options(..., verify=False, ...)
-      - pattern: $SESSION.request(..., verify=False, ...)
+    patterns:
+      - pattern-either:
+          - pattern: requests.get(..., verify=$V, ...)
+          - pattern: requests.post(..., verify=$V, ...)
+          - pattern: requests.put(..., verify=$V, ...)
+          - pattern: requests.delete(..., verify=$V, ...)
+          - pattern: requests.patch(..., verify=$V, ...)
+          - pattern: requests.head(..., verify=$V, ...)
+          - pattern: requests.options(..., verify=$V, ...)
+          - pattern: requests.request(..., verify=$V, ...)
+          - pattern: $SESSION.get(..., verify=$V, ...)
+          - pattern: $SESSION.post(..., verify=$V, ...)
+          - pattern: $SESSION.put(..., verify=$V, ...)
+          - pattern: $SESSION.delete(..., verify=$V, ...)
+          - pattern: $SESSION.patch(..., verify=$V, ...)
+          - pattern: $SESSION.head(..., verify=$V, ...)
+          - pattern: $SESSION.options(..., verify=$V, ...)
+          - pattern: $SESSION.request(..., verify=$V, ...)
+      # Fire only on the literal `False` (unchanged detection), and focus the
+      # match/fix on that value token so the autofix flips just it, leaving the
+      # rest of the call intact.
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^False$
+      - focus-metavariable: $V
+    # Safe, deterministic autofix: `True` is the library default (verification
+    # on) and the exact value the rule treats as compliant, so it fully resolves
+    # the finding. Only the value token is rewritten (`verify=False` -> `verify=True`).
+    fix: "True"
     metadata:
       oauthlint-rule-id: AUTH-PY-FLOW-002
       oauthlint-doc-url: https://oauthlint.dev/rules/py-flow-requests-verify-disabled

package/rules/py/jwt/verify-claims-disabled.yml

@@ -0,0 +1,45 @@
+rules:
+  - id: auth.py.jwt.verify-claims-disabled
+    languages:
+      - python
+    severity: WARNING
+    message: |
+      PyJWT decode disables audience or issuer checks.
+
+      `jwt.decode(...)` is called with an `options` dict that turns off a claim
+      check: `"verify_aud": False`, `"verify_iss": False`, or
+      `"verify_nbf": False`. Skipping these lets a token minted for a different
+      audience or issuer (for example one from another tenant or a lower-trust
+      service) be accepted here, defeating the boundary those claims are meant
+      to enforce (CWE-347).
+
+      Remove the disabling option and validate the claim, e.g.
+      `jwt.decode(token, key, algorithms=["RS256"], audience="api",
+      issuer="https://issuer.example.com")`. PyJWT only checks `aud`/`iss` when
+      you pass the expected value, so supply it rather than disabling the check.
+    # Scoped to PyJWT's decode `options` dict. We match ONLY the aud/iss/nbf
+    # keys; `verify_signature` is reported by auth.py.jwt.no-verify and
+    # `verify_exp` by auth.py.jwt.no-expiration, so neither is matched here and
+    # we avoid duplicate findings.
+    patterns:
+      - pattern-either:
+          - pattern: jwt.decode(..., options=$OPTS, ...)
+          - pattern: decode(..., options=$OPTS, ...)
+      - metavariable-pattern:
+          metavariable: $OPTS
+          pattern-either:
+            - pattern: '{..., "verify_aud": False, ...}'
+            - pattern: '{..., "verify_iss": False, ...}'
+            - pattern: '{..., "verify_nbf": False, ...}'
+    metadata:
+      oauthlint-rule-id: AUTH-PY-JWT-008
+      oauthlint-doc-url: https://oauthlint.dev/rules/py-jwt-verify-claims-disabled
+      category: security
+      cwe: CWE-347
+      owasp: API2:2023
+      llm-prevalence: MEDIUM
+      technology:
+        - pyjwt
+      references:
+        - https://pyjwt.readthedocs.io/en/stable/api.html#jwt.decode
+        - https://cwe.mitre.org/data/definitions/347.html

package/rules/py/oauth/token-request-verify-disabled.yml

@@ -21,10 +21,20 @@ rules:
     # `verify="/path/ca.pem"` are not flagged. This is distinct from
     # auth.py.flow.requests-verify-disabled, which covers the `requests` HTTP
     # verbs (`get`/`post`/…); here the sink is the OAuth token-exchange call.
-    pattern-either:
-      - pattern: $C.fetch_token(..., verify=False, ...)
-      - pattern: $C.refresh_token(..., verify=False, ...)
-      - pattern: $C.fetch_access_token(..., verify=False, ...)
+    patterns:
+      - pattern-either:
+          - pattern: $C.fetch_token(..., verify=$V, ...)
+          - pattern: $C.refresh_token(..., verify=$V, ...)
+          - pattern: $C.fetch_access_token(..., verify=$V, ...)
+      # Fire only on the literal `False` (unchanged detection), and focus the
+      # match/fix on that value token so the autofix flips just it.
+      - metavariable-regex:
+          metavariable: $V
+          regex: ^False$
+      - focus-metavariable: $V
+    # Safe, deterministic autofix: `True` is the default (verification on) and the
+    # exact value the rule treats as compliant, so it resolves the finding.
+    fix: "True"
     metadata:
       oauthlint-rule-id: AUTH-PY-OAUTH-005
       oauthlint-doc-url: https://oauthlint.dev/rules/py-oauth-token-request-verify-disabled