rules:
  - id: auth.java.jwt.hardcoded-secret
    languages:
      - java
    severity: ERROR
    message: |
      A JWT signing key is hard-coded as a string literal (CWE-798). Anyone with
      access to the source, the compiled artifact, or the version-control history
      can read the secret and forge valid tokens, changing the subject, roles,
      or expiry at will, because the signature will still verify. This is a common
      AI-generated mistake: a placeholder secret is pasted inline to "make signing
      work" and is never moved out of the code.

      Load the signing key from outside the source: an environment variable
      (`System.getenv("JWT_SECRET")`), a configuration property, or a dedicated
      secret manager (Vault, AWS Secrets Manager, etc.). With jjwt, build the key
      from those bytes via `Keys.hmacShaKeyFor(secret.getBytes(...))`. Never commit
      the key, and rotate any secret that has already been checked in.
    # jjwt (io.jsonwebtoken): flag only STRING LITERALS in a signing-key position.
    #   - Keys.hmacShaKeyFor("literal".getBytes(...))   (current API)
    #   - signWith(SignatureAlgorithm.HS*, "literal")    (legacy API)
    #   - setSigningKey("literal" [.getBytes(...)])       (parser side)
    # A variable, System.getenv(...), or a loaded Key/SecretKey is NOT matched
    # because the argument is constrained to a `"..."` literal.
    pattern-either:
      - pattern: io.jsonwebtoken.security.Keys.hmacShaKeyFor("...".getBytes(...))
      - pattern: Keys.hmacShaKeyFor("...".getBytes(...))
      - pattern: $B.signWith($ALG, "...")
      - pattern: $P.setSigningKey("...")
      - pattern: $P.setSigningKey("...".getBytes(...))
    metadata:
      oauthlint-rule-id: AUTH-JAVA-JWT-002
      oauthlint-doc-url: https://oauthlint.dev/rules/java-jwt-hardcoded-secret
      category: security
      cwe: CWE-798
      owasp: API2:2023
      llm-prevalence: HIGH
      technology:
        - jjwt
      references:
        - https://github.com/jwtk/jjwt#signing-key
        - https://cwe.mitre.org/data/definitions/798.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html