rules:
  - id: vue-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: |
              new https.Agent({..., rejectUnauthorized: false, ...})
          - pattern: process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"
          - pattern: process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = "0"
          - pattern-regex: 'rejectUnauthorized\s*:\s*false'
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled. This allows man-in-the-middle
      attacks and completely defeats TLS security.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, nodejs, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: vue-tls-version-too-old
    patterns:
      - pattern-regex: 'minVersion\s*:\s*[''"]TLSv1(?:\.1)?[''"]'
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, nodejs, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: vue-tls-weak-cipher-suite
    patterns:
      - pattern-regex: 'ciphers\s*:\s*[''"](?:RC4|DES|NULL|aNULL|eNULL)[^''"]*[''"]'
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, nodejs, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: vue-mixed-content-http
    patterns:
      - pattern-regex: '(?:fetch|axios\.get|axios\.post|axios\.put|axios\.delete)\s*\(\s*[''"]http://'
    message: >-
      SECURITY VULNERABILITY: HTTP request from Vue component. All API calls should use HTTPS to protect
      data in transit and enable post-quantum TLS upgrades. Modern browsers block mixed content (HTTP from
      HTTPS pages).
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript, tls]
      cwe:
        - "CWE-319: Cleartext Transmission of Sensitive Information"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 7
