misonijnik · Jul 29, 2026 · Jun 3, 2026 · Jun 3, 2026 · Jul 3, 2026 · Jul 4, 2026
diff --git a/rules/README.md b/rules/README.md
@@ -91,31 +91,50 @@ Key points:
 
 Many rules under `ruleset/` combine multiple library rules using **`mode: join`**.
 
+Library rules expose their roles through tags:
+
+```yaml
+- id: java-ssrf-sink
+  options:
+    lib: true
+  tags:
+    - ssrf-sink
+```
+
 Example (from `ruleset/java/security/ssrf.yaml`):
 
 ```yaml
-- id: ssrf-in-servlet-app
+- id: ssrf
   languages:
     - java
   mode: join
   join:
     refs:
-      - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
-        as: untrusted-data
-      - rule: java/lib/generic/ssrf-sinks.yaml#java-ssrf-sink
+      - tag: servlet-untrusted-data-source
+        as: servlet-untrusted-data
+      - tag: spring-untrusted-data-source
+        as: spring-untrusted-data
+      - tag: ssrf-sink
         as: sink
     on:
-      - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+      - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+      - 'spring-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
 ```
 
 Semantics:
 
 - `mode: join` derives a composite rule from other rules referenced in `join.refs`.
-- `refs` defines:
-  - `rule`: path to the library rule file plus `#<rule-id>` inside that YAML
-  - `as`: local alias for referencing captures/variables from that rule
-- `on` describes how to correlate matches from referenced rules:
-  - `untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED` expresses a **dataflow relationship** between the `$UNTRUSTED` captured in the source rule and the same `$UNTRUSTED` captured in the sink rule.
+- Each `ref` selects a library rule and assigns a local alias:
+  - `tag` selects every enabled rule with that tag in the join's language. Adding the same tag to a
+    custom rule extends the join.
+  - `rule` selects one rule by `<path>#<rule-id>`.
+  - `as` defines the alias used in `on`.
+- `on` correlates captures from the referenced rules. For example,
+  `servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED` requires dataflow from the source capture
+  to the sink capture.
+
+Built-in joins use language-scoped, per-source and per-sink tags. Use `rule` when a join must
+reference one specific rule.
 
 This join mode is **based on Semgrep's join mode**, but OpenTaint extends it with custom features (such as the `->` notation in the `on` section) to express taint-style flows across multiple rule components.
 
@@ -227,7 +246,8 @@ When introducing or changing rules, follow these guidelines:
    - Add `options.lib: true` for library fragments in `lib/` (or exceptionally in `ruleset/` if they are not meant to be executed directly).
 
 3. **Avoid duplicates**
-   - Reuse existing library rules from `lib/` and compose them via `mode: join` where applicable.
+   - Reuse library rules from `lib/` and compose them with `mode: join` where applicable.
+   - Reference join sources and sinks by `tag`, and tag each new library source or sink.
 
 4. **Update tests**
    - Add at least one `@PositiveRuleSample` (and typically `@NegativeRuleSample`) under `test/src/main/java/security/`.

diff --git a/rules/ruleset/go/lib/cmdi-sinks.yaml b/rules/ruleset/go/lib/cmdi-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: cmdi-sinks
     options:
       lib: true
+    tags:
+      - command-injection-sink
     severity: NOTE
     message: Untrusted data reaches an OS command execution API
     metadata:

diff --git a/rules/ruleset/go/lib/http-sources-header-index.yaml b/rules/ruleset/go/lib/http-sources-header-index.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources-header-index
     options:
       lib: true
+    tags:
+      - beego-header-untrusted-data-source
     severity: NOTE
     message: Untrusted beego request-header value source
     metadata:

diff --git a/rules/ruleset/go/lib/http-sources-requesturi.yaml b/rules/ruleset/go/lib/http-sources-requesturi.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources-requesturi
     options:
       lib: true
+    tags:
+      - request-uri-untrusted-data-source
     severity: NOTE
     message: Untrusted request URI source
     metadata:

diff --git a/rules/ruleset/go/lib/http-sources.yaml b/rules/ruleset/go/lib/http-sources.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources
     options:
       lib: true
+    tags:
+      - http-untrusted-data-source
     severity: NOTE
     message: Untrusted user input originates here
     metadata:

diff --git a/rules/ruleset/go/lib/path-sinks.yaml b/rules/ruleset/go/lib/path-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: path-sinks
     options:
       lib: true
+    tags:
+      - path-traversal-sink
     severity: NOTE
     message: Untrusted data reaches a filesystem path API
     metadata:

diff --git a/rules/ruleset/go/lib/sql-sinks.yaml b/rules/ruleset/go/lib/sql-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: sql-sinks
     options:
       lib: true
+    tags:
+      - sqli-sink
     severity: NOTE
     message: Untrusted data reaches a SQL execution API
     metadata:

diff --git a/rules/ruleset/go/lib/ssrf-sinks.yaml b/rules/ruleset/go/lib/ssrf-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ssrf-sinks
     options:
       lib: true
+    tags:
+      - ssrf-sink
     severity: NOTE
     message: Untrusted data reaches an outbound HTTP request API
     metadata:

diff --git a/rules/ruleset/go/lib/ssti-sinks.yaml b/rules/ruleset/go/lib/ssti-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ssti-sinks
     options:
       lib: true
+    tags:
+      - ssti-sink
     severity: NOTE
     message: Untrusted data reaches a template-source parse API
     metadata:

diff --git a/rules/ruleset/go/lib/xss-sinks.yaml b/rules/ruleset/go/lib/xss-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: xss-sinks
     options:
       lib: true
+    tags:
+      - xss-sink
     severity: NOTE
     message: Untrusted data reaches an HTTP response write API
     metadata:

diff --git a/rules/ruleset/go/security/cmdinj.yaml b/rules/ruleset/go/security/cmdinj.yaml
@@ -53,11 +53,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/http-sources-header-index.yaml#http-sources-header-index
+        - tag: beego-header-untrusted-data-source
           as: extra_header
-        - rule: go/lib/cmdi-sinks.yaml#cmdi-sinks
+        - tag: command-injection-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'

diff --git a/rules/ruleset/go/security/path-traversal.yaml b/rules/ruleset/go/security/path-traversal.yaml
@@ -53,9 +53,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/path-sinks.yaml#path-sinks
+        - tag: path-traversal-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/sql-injection.yaml b/rules/ruleset/go/security/sql-injection.yaml
@@ -48,13 +48,13 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/http-sources-requesturi.yaml#http-sources-requesturi
+        - tag: request-uri-untrusted-data-source
           as: extra_requesturi
-        - rule: go/lib/http-sources-header-index.yaml#http-sources-header-index
+        - tag: beego-header-untrusted-data-source
           as: extra_header
-        - rule: go/lib/sql-sinks.yaml#sql-sinks
+        - tag: sqli-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'

diff --git a/rules/ruleset/go/security/ssrf.yaml b/rules/ruleset/go/security/ssrf.yaml
@@ -55,9 +55,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/ssrf-sinks.yaml#ssrf-sinks
+        - tag: ssrf-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/ssti.yaml b/rules/ruleset/go/security/ssti.yaml
@@ -48,9 +48,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/ssti-sinks.yaml#ssti-sinks
+        - tag: ssti-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/xss.yaml b/rules/ruleset/go/security/xss.yaml
@@ -48,9 +48,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/xss-sinks.yaml#xss-sinks
+        - tag: xss-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/lib/generic/code-injection-sinks.yaml b/rules/ruleset/java/lib/generic/code-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ognl-injection-sinks
     options:
       lib: true
+    tags:
+      - ognl-injection-sink
     severity: NOTE
     message: Untrusted input reaches OGNL expression
     metadata:
@@ -54,6 +56,8 @@ rules:
   - id: dangerous-groovy-shell
     options:
       lib: true
+    tags:
+      - groovy-injection-sink
     severity: NOTE
     message: Groovy shell run of externally-manipulated script
     metadata:
@@ -84,6 +88,8 @@ rules:
   - id: dangerous-script-engine-eval
     options:
       lib: true
+    tags:
+      - script-engine-injection-sink
     severity: NOTE
     message: Risky code evaluation with user-controled value
     metadata:

diff --git a/rules/ruleset/java/lib/generic/command-injection-sinks.yaml b/rules/ruleset/java/lib/generic/command-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: command-injection-sinks
     options:
       lib: true
+    tags:
+      - command-injection-sink
     severity: NOTE
     message: Executing OS command with user-controlled data
     metadata:
@@ -46,6 +48,8 @@ rules:
   - id: java-expression-language-sinks
     options:
       lib: true
+    tags:
+      - el-injection-sink
     severity: NOTE
     message: Java EL evaluation directly with user-supplied input
     metadata:

diff --git a/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml b/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-xpath-injection-sinks
     options:
       lib: true
+    tags:
+      - xpath-injection-sink
     severity: NOTE
     message: XPath query contains user-manipulated data
     metadata:
@@ -21,6 +23,8 @@ rules:
   - id: java-mongodb-nosql-injection
     options:
       lib: true
+    tags:
+      - mongodb-injection-sink
     severity: NOTE
     message: >-
       User-controled data passed into a NoSQL query using the 'where' evaluation operator.

diff --git a/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml b/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-http-response-splitting-sink
     options:
       lib: true
+    tags:
+      - http-response-splitting-sink
     severity: NOTE
     message: Improper neutralization of CRLF sequences in HTTP headers
     metadata:

diff --git a/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml b/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-ldap-injection-sinks
     options:
       lib: true
+    tags:
+      - ldap-injection-sink
     severity: NOTE
     message: Call of LDAP injection-sensitive function with untrusted data.
     metadata:

diff --git a/rules/ruleset/java/lib/generic/logging-sinks.yaml b/rules/ruleset/java/lib/generic/logging-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-logging-sinks
     options:
       lib: true
+    tags:
+      - log-injection-sink
     severity: NOTE
     message: Logging the data
     metadata:
@@ -33,6 +35,8 @@ rules:
   - id: seam-log-injection-sinks
     options:
       lib: true
+    tags:
+      - seam-log-injection-sink
     severity: NOTE
     message: Potential injection into Seam logging expression language
     metadata:

diff --git a/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml b/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-path-traversal-sinks
     options:
       lib: true
+    tags:
+      - path-traversal-sink
     severity: NOTE
     message: Use a file with untrusted path
     metadata:

diff --git a/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml b/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: seam-untrusted-data-source
     options:
       lib: true
+    tags:
+      - seam-untrusted-data-source
     message: Untrusted data flows from here
     severity: NOTE
     metadata:

diff --git a/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-response-injection-sink
     options:
       lib: true
+    tags:
+      - servlet-response-injection-sink
     severity: NOTE
     message: Direct write of unvalidated user input into response
     metadata:

diff --git a/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml b/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-untrusted-data-source
     options:
       lib: true
+    tags:
+      - servlet-untrusted-data-source
     severity: NOTE
     message: Untrusted data flows from here
     metadata:

diff --git a/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-unvalidated-redirect-sinks
     options:
       lib: true
+    tags:
+      - servlet-unvalidated-redirect-sink
     severity: NOTE
     message: Potential redirect to an untrusted URL
     metadata:

diff --git a/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-xss-html-response-sink
     options:
       lib: true
+    tags:
+      - servlet-xss-sink
     severity: NOTE
     message: Direct write of unvalidated user input into a response without safe content type
     metadata:

diff --git a/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml b/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-smtp-crlf-injection-sinks
     options:
       lib: true
+    tags:
+      - smtp-injection-sink
     severity: NOTE
     message: Unvalidated user-manipulated data reaches sensitive MimeMessage parts
     metadata: