rules:
  - id: php-weak-symmetric-cipher
    pattern-either:
      - pattern: openssl_encrypt(..., 'AES-128-CBC', ...)
      - pattern: openssl_encrypt(..., 'AES-128-ECB', ...)
      - pattern: openssl_encrypt(..., 'AES-128-GCM', ...)
      - pattern: openssl_encrypt(..., 'AES-128-CFB', ...)
      - pattern: openssl_encrypt(..., "AES-128-CBC", ...)
      - pattern: openssl_encrypt(..., "AES-128-ECB", ...)
      - pattern: openssl_encrypt(..., "AES-128-GCM", ...)
      - pattern: openssl_encrypt(..., "AES-128-CFB", ...)
      - pattern: openssl_encrypt(..., 'AES-192-CBC', ...)
      - pattern: openssl_encrypt(..., 'AES-192-ECB', ...)
      - pattern: openssl_encrypt(..., 'AES-192-GCM', ...)
      - pattern: openssl_encrypt(..., 'AES-192-CFB', ...)
      - pattern: openssl_encrypt(..., "AES-192-CBC", ...)
      - pattern: openssl_encrypt(..., "AES-192-ECB", ...)
      - pattern: openssl_encrypt(..., "AES-192-GCM", ...)
      - pattern: openssl_encrypt(..., "AES-192-CFB", ...)
      - pattern: openssl_encrypt(..., 'DES', ...)
      - pattern: openssl_encrypt(..., 'DES-ECB', ...)
      - pattern: openssl_encrypt(..., 'DES-CBC', ...)
      - pattern: openssl_encrypt(..., 'DES-EDE', ...)
      - pattern: openssl_encrypt(..., 'DES-EDE3', ...)
      - pattern: openssl_encrypt(..., 'RC4', ...)
      - pattern: openssl_encrypt(..., "DES", ...)
      - pattern: openssl_encrypt(..., "DES-ECB", ...)
      - pattern: openssl_encrypt(..., "DES-CBC", ...)
      - pattern: openssl_encrypt(..., "DES-EDE", ...)
      - pattern: openssl_encrypt(..., "DES-EDE3", ...)
      - pattern: openssl_encrypt(..., "RC4", ...)
      - pattern: openssl_decrypt(..., 'DES', ...)
      - pattern: openssl_decrypt(..., 'DES-ECB', ...)
      - pattern: openssl_decrypt(..., 'DES-CBC', ...)
      - pattern: openssl_decrypt(..., 'DES-EDE', ...)
      - pattern: openssl_decrypt(..., 'DES-EDE3', ...)
      - pattern: openssl_decrypt(..., 'RC4', ...)
      - pattern: mcrypt_encrypt(MCRYPT_DES, ...)
      - pattern: mcrypt_encrypt(MCRYPT_3DES, ...)
      - pattern: mcrypt_decrypt(MCRYPT_DES, ...)
      - pattern: mcrypt_decrypt(MCRYPT_3DES, ...)
    message: >-
      QUANTUM VULNERABILITY: AES-128/192 provide only 64/96-bit quantum security
      via Grover's algorithm. DES/3DES/RC4 are classically broken and quantum-vulnerable.
      Use AES-256 for quantum resistance.
    severity: WARNING
    languages:
      - php
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 75

  - id: php-rsa-quantum-vulnerable
    pattern-either:
      - pattern: openssl_pkey_new(['private_key_type' => OPENSSL_KEYTYPE_RSA, ...])
      - pattern: openssl_pkey_new([..., 'private_key_type' => OPENSSL_KEYTYPE_RSA])
      - pattern: openssl_public_encrypt(...)
      - pattern: openssl_private_encrypt(...)
      - pattern: openssl_private_decrypt(...)
      - pattern: openssl_public_decrypt(...)
    message: >-
      QUANTUM VULNERABILITY: RSA is broken by Shor's algorithm regardless of key size.
      Migrate to post-quantum alternatives (CRYSTALS-Kyber for encryption,
      CRYSTALS-Dilithium for signatures).
    severity: ERROR
    languages:
      - php
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 10
