rules:
  - id: auth.py.cors.fastapi-wildcard-credentials
    languages:
      - python
    severity: ERROR
    message: |
      FastAPI CORS allows any origin with credentials.

      Starlette's `CORSMiddleware` is configured with a wildcard origin
      (`allow_origins=["*"]` or `allow_origin_regex=".*"`) together with
      `allow_credentials=True`. The CORS spec forbids
      `Access-Control-Allow-Origin: *` alongside
      `Access-Control-Allow-Credentials: true`, so Starlette silently reflects
      the caller's `Origin` instead, turning the wildcard into "allow every
      site" for credentialed requests. Any website can then read authenticated
      responses, leaking cookies, session and OAuth tokens cross-origin
      (CWE-942).

      Credentialed CORS needs an explicit allow-list of trusted origins, e.g.
      `allow_origins=["https://app.example.com"], allow_credentials=True`. If
      the endpoint is genuinely public, drop credentials:
      `allow_origins=["*"], allow_credentials=False`.
    # Require the co-occurrence of a wildcard origin AND credentials on the SAME
    # CORSMiddleware configuration. The first arm scopes to the `CORSMiddleware`
    # symbol (either `app.add_middleware(CORSMiddleware, ...)` or a direct
    # `CORSMiddleware(...)`); the AND-ed arms then demand both
    # `allow_credentials=True` and a wildcard origin, so argument order does not
    # matter and an explicit allow-list (or credentials disabled) never fires.
    patterns:
      - pattern-either:
          - pattern: $APP.add_middleware(CORSMiddleware, ...)
          - pattern: CORSMiddleware(...)
      - pattern: $F(..., allow_credentials=True, ...)
      - pattern-either:
          - pattern: $F(..., allow_origins=["*"], ...)
          - pattern: $F(..., allow_origin_regex=".*", ...)
    metadata:
      oauthlint-rule-id: AUTH-PY-CORS-002
      oauthlint-doc-url: https://oauthlint.dev/rules/py-cors-fastapi-wildcard-credentials
      category: security
      cwe: CWE-942
      owasp: API8:2023
      llm-prevalence: HIGH
      technology:
        - fastapi
      references:
        - https://www.starlette.io/middleware/#corsmiddleware
        - https://fastapi.tiangolo.com/tutorial/cors/
        - https://cwe.mitre.org/data/definitions/942.html