rules:
  # Uses pattern-regex -- opengrep's Apex AST parser does not support
  # pattern/pattern-either for method call matching.

  - id: apex-http-not-https
    pattern-regex: '\.setEndpoint\s*\(\s*[''"]http://'
    message: >-
      SECURITY VULNERABILITY: HTTP endpoint used instead of HTTPS. All Salesforce callouts should use
      HTTPS to protect data in transit. HTTP connections cannot use TLS and are completely unencrypted --
      post-quantum security requires TLS 1.3.
    severity: ERROR
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, tls]
      cwe:
        - "CWE-319: Cleartext Transmission of Sensitive Information"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 9

  - id: apex-named-credential-callout
    pattern-regex: '\.setEndpoint\s*\(\s*[''"]callout:'
    message: >-
      INFO: Salesforce named credential used for callout. Ensure the named credential
      is configured to use TLS 1.2+ in Salesforce Setup. Verify the target server
      supports TLS 1.3 for post-quantum readiness.
    severity: INFO
    languages: [apex]
    metadata:
      category: security
      technology: [salesforce, apex, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 4
