rules:
  - id: auth.xml.android.hardcoded-secret-strings
    languages:
      - xml
    severity: ERROR
    message: |
      A credential (client secret, API key, password, bearer token) is hard-coded
      as a value in `res/values/strings.xml`. String resources are compiled
      verbatim into the APK and are recovered in seconds by unzipping/decompiling
      the app, so any secret placed here is effectively public (CWE-798).
      AI-generated Android code drops secrets into strings.xml because it is the
      "official" place for constants.

      A public mobile client should hold no client secret at all (use PKCE). For an
      unavoidable key, inject it at build time via `BuildConfig` / Gradle
      properties or fetch it from a backend at runtime, never commit it as a
      string resource. Note: a public `client_id` and OAuth `scope` list are not
      secrets and are intentionally not flagged.
    # Fires only when the resource NAME denotes a credential and the value is long
    # enough to be a real secret. `client_id` and `*_scope` carry no secret keyword
    # so they are excluded by the name filter; short labels fail the length floor.
    patterns:
      - pattern: <string name="$N">$V</string>
      - metavariable-regex:
          metavariable: $N
          regex: '(?i).*(secret|api[_-]?key|client_secret|password|token|bearer|private_key).*'
      # The value must LOOK like a secret: a single run of secret-shaped
      # characters, no spaces, colons or slashes. This drops UI labels
      # ("Refresh token"), scopes ("openid profile"), and URLs, which are the
      # common false positives on strings named `*token*`.
      - metavariable-regex:
          metavariable: $V
          regex: '^[A-Za-z0-9_\-+=.]{16,}$'
    metadata:
      oauthlint-rule-id: AUTH-XML-ANDROID-002
      oauthlint-doc-url: https://oauthlint.dev/rules/xml-android-hardcoded-secret-strings
      category: security
      cwe: CWE-798
      owasp: API2:2023
      llm-prevalence: HIGH
      technology:
        - android
      references:
        - https://developer.android.com/privacy-and-security/security-tips#UserData
        - https://cwe.mitre.org/data/definitions/798.html