rules:
  - id: auth.ruby.cors.wildcard-origin-with-credentials
    languages:
      - ruby
    severity: WARNING
    message: |
      A rack-cors `allow` block combines `origins '*'` with
      `credentials: true`. That instructs browsers to send cookies and
      Authorization headers to a resource that trusts EVERY origin, which is
      exactly the combination the CORS spec forbids and a CSRF/data-theft
      primitive (CWE-942). LLM-generated CORS setups routinely pair a wildcard
      origin with credentials to make cross-site auth "just work".

      Decide what the endpoint actually needs:
       - Public, no cookies/auth cross-site -> `origins '*'` with no
         `credentials: true` (the default).
       - Authenticated for a known frontend -> enumerate the exact origins,
         e.g. `origins 'https://app.example.com'`, and keep `credentials: true`.

      Never combine a wildcard origin with credentials enabled.
    # Anchor on `credentials: true`, but only when it lives inside a rack-cors
    # allow-block that ALSO declares a wildcard origin. The `...` around the
    # origins line makes the two anchors order-independent. A wildcard without
    # credentials, or a specific origin with credentials, never matches.
    patterns:
      - pattern: 'resource ..., credentials: true, ...'
      - pattern-either:
          - pattern-inside: |
              allow do
                ...
                origins '*'
                ...
              end
          - pattern-inside: |
              allow do
                ...
                origins "*"
                ...
              end
    metadata:
      oauthlint-rule-id: AUTH-RUBY-CORS-001
      oauthlint-doc-url: https://oauthlint.dev/rules/ruby-cors-wildcard-origin-with-credentials
      category: security
      cwe: CWE-942
      owasp: API8:2023
      llm-prevalence: HIGH
      technology:
        - rack-cors
      references:
        - https://github.com/cyu/rack-cors#origin
        - https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS/Errors/CORSNotSupportingCredentials