rules:
  - id: ruby-weak-symmetric-cipher
    pattern-either:
      - pattern: OpenSSL::Cipher.new('AES-128-CBC')
      - pattern: OpenSSL::Cipher.new('AES-128-ECB')
      - pattern: OpenSSL::Cipher.new('AES-128-GCM')
      - pattern: OpenSSL::Cipher.new('AES-128-CFB')
      - pattern: OpenSSL::Cipher.new("AES-128-CBC")
      - pattern: OpenSSL::Cipher.new("AES-128-ECB")
      - pattern: OpenSSL::Cipher.new("AES-128-GCM")
      - pattern: OpenSSL::Cipher.new("AES-128-CFB")
      - pattern: OpenSSL::Cipher.new('AES-192-CBC')
      - pattern: OpenSSL::Cipher.new('AES-192-ECB')
      - pattern: OpenSSL::Cipher.new('AES-192-GCM')
      - pattern: OpenSSL::Cipher.new('AES-192-CFB')
      - pattern: OpenSSL::Cipher.new("AES-192-CBC")
      - pattern: OpenSSL::Cipher.new("AES-192-ECB")
      - pattern: OpenSSL::Cipher.new("AES-192-GCM")
      - pattern: OpenSSL::Cipher.new("AES-192-CFB")
      - pattern: OpenSSL::Cipher.new('DES')
      - pattern: OpenSSL::Cipher.new('DES-ECB')
      - pattern: OpenSSL::Cipher.new('DES-CBC')
      - pattern: OpenSSL::Cipher.new('DES-EDE')
      - pattern: OpenSSL::Cipher.new('DES-EDE3')
      - pattern: OpenSSL::Cipher.new('RC4')
      - pattern: OpenSSL::Cipher.new("DES")
      - pattern: OpenSSL::Cipher.new("DES-ECB")
      - pattern: OpenSSL::Cipher.new("DES-CBC")
      - pattern: OpenSSL::Cipher.new("DES-EDE")
      - pattern: OpenSSL::Cipher.new("DES-EDE3")
      - pattern: OpenSSL::Cipher.new("RC4")
      - pattern: OpenSSL::Cipher::DES.new
      - pattern: OpenSSL::Cipher::DES3.new
    message: >-
      QUANTUM VULNERABILITY: AES-128/192 provide only 64/96-bit quantum security
      via Grover's algorithm. DES/3DES/RC4 are classically broken and quantum-vulnerable.
      Use AES-256 for quantum resistance.
    severity: WARNING
    languages:
      - ruby
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 75
