# =============================================================================
# Cerebion Rivet -- Groovy Quantum Cryptography Vulnerability Rules
# =============================================================================
# IMPORTANT: Groovy has NO native opengrep parser.
# All rules in this file MUST use:
#   languages: [generic]
#   pattern-regex: "<regex>"
#
# The `generic` language mode performs line-by-line regex matching against
# raw source text, which is the correct approach for languages without a
# dedicated AST parser in opengrep. Groovy source shares Java-like syntax
# but is not covered by the `java` parser due to dynamic language features.
# =============================================================================

rules:
  - id: groovy-use-of-md5-quantum
    pattern-regex: "MessageDigest\\.getInstance\\s*\\(\\s*[\"'](?:MD5|MD2)[\"']"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: groovy-use-of-sha1-quantum
    pattern-regex: "MessageDigest\\.getInstance\\s*\\(\\s*[\"'](?:SHA-?1)[\"']"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: groovy-use-of-des-cipher-quantum
    pattern-regex: "Cipher\\.getInstance\\s*\\(\\s*[\"'](?:DES|DESede|DES/|DESede/)"
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: groovy-use-of-rc4-cipher-quantum
    pattern-regex: "Cipher\\.getInstance\\s*\\(\\s*[\"'](?:RC4|RC2|ARCFOUR)"
    message: >-
      RC4 is completely broken and banned by RFC 7465. Migrate to AES-256-GCM or ChaCha20-Poly1305.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: groovy-use-of-rsa-keygen-quantum
    pattern-regex: "KeyPairGenerator\\.getInstance\\s*\\(\\s*[\"'](?:RSA|DSA)[\"']"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: groovy-aes-ecb-mode
    pattern-regex: "Cipher\\.getInstance\\s*\\(\\s*[\"'][^\"']*\\/ECB\\/"
    message: >-
      AES in ECB mode leaks data patterns -- identical plaintext blocks produce identical ciphertext. Use
      AES-256-GCM for authenticated encryption.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 8

  - id: groovy-use-of-dh-quantum
    pattern-regex: "KeyAgreement\\.getInstance\\s*\\(\\s*[\"']DH[\"']"
    message: >-
      DH/DSA is broken by Shor's algorithm. Migrate to ML-KEM (FIPS 203) for key exchange or ML-DSA (FIPS
      204) for signatures.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [groovy, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8
