rules:
  - id: swift-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: $CFG.tlsMinimumSupportedProtocolVersion = .TLSv10
          - pattern: $CFG.tlsMinimumSupportedProtocolVersion = .TLSv11
          - pattern: $CFG.tlsMinimumSupportedProtocol = .tlsProtocol1
          - pattern: $CFG.tlsMinimumSupportedProtocol = .sslProtocol3
          - pattern: $CFG.tlsMinimumSupportedProtocol = .sslProtocol2
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [swift]
    metadata:
      category: security
      technology: [swift, ios, macos, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: swift-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: |
              URLSession(configuration: $CFG, delegate: $D, delegateQueue: $Q)
          - pattern: $CHALLENGE.protectionSpace.serverTrust
          - pattern: |
              SecTrustEvaluateWithError($TRUST, nil)
    message: >-
      SECURITY VULNERABILITY: Review TLS certificate validation in URLSession delegate. Returning
      .useCredential with an unverified trust object allows MITM attacks.
    severity: WARNING
    languages: [swift]
    metadata:
      category: security
      technology: [swift, ios, macos, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: LOW
      likelihood: MEDIUM
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 7

  - id: swift-tls-nsurlsession-insecure
    pattern: |
      $HANDLER(.useCredential, ...)
    message: >-
      SECURITY VULNERABILITY: URLSession authentication challenge handler may be accepting all
      certificates unconditionally. This enables MITM attacks.
    severity: WARNING
    languages: [swift]
    metadata:
      category: security
      technology: [swift, ios, macos, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: LOW
      likelihood: MEDIUM
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 7
