rules:
  - id: auth.java.oauth.hardcoded-client-secret
    languages:
      - java
    severity: WARNING
    message: |
      An OAuth 2.0 client secret is hard-coded as a string literal in a Spring
      Security `ClientRegistration` builder (`.clientSecret("...")`). The client
      secret authenticates your application to the authorization server's token
      endpoint; committed to source control it is one search away from
      compromise, letting an attacker impersonate your client to redeem
      authorization codes and mint access tokens (CWE-798). This is a common
      AI-generated mistake: a literal secret is inlined to make the OAuth sample
      "just work" and never externalized.

      Load the secret from outside the source: a `@Value("${...}")`-injected
      property, `System.getenv(...)`, `Environment.getProperty(...)`, or a secret
      manager (Vault, AWS Secrets Manager). In Spring Boot, prefer
      `spring.security.oauth2.client.registration.<id>.client-secret` bound from
      an environment variable. Rotate any secret already checked in.
    # Only a STRING LITERAL passed to `.clientSecret(...)` fires; a variable,
    # `System.getenv(...)`, or `env.getProperty(...)` is not a literal and is
    # structurally excluded. The allow-list regexes drop `${...}` property
    # placeholders, `<...>` doc stubs, and obvious placeholder secrets.
    patterns:
      - pattern: $B.clientSecret("...")
      - pattern-not-regex: 'clientSecret\(\s*"\$\{?[^"]*\}?"'
      - pattern-not-regex: 'clientSecret\(\s*"<[^"]*>"'
      - pattern-not-regex: '(?i)clientSecret\(\s*"(?:your[-_]|example|placeholder|xxx+|todo|changeme|change[-_]?me|replace|dummy|sample|secret")'
    paths:
      exclude:
        - "**/test/**"
        - "**/*Test.java"
        - "**/*Tests.java"
        - "**/samples/**"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
    metadata:
      oauthlint-rule-id: AUTH-JAVA-OAUTH-004
      oauthlint-doc-url: https://oauthlint.dev/rules/java-oauth-hardcoded-client-secret
      category: security
      cwe: CWE-798
      owasp: API2:2023
      llm-prevalence: MEDIUM
      technology:
        - spring-security
      references:
        - https://docs.spring.io/spring-security/reference/servlet/oauth2/client/core.html
        - https://cwe.mitre.org/data/definitions/798.html
        - https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html