rules:
  - id: elixir-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: :ssl.connect($HOST, $PORT, [..., {:versions, [:tlsv1]}, ...])
          - pattern: :ssl.connect($HOST, $PORT, [..., {:versions, [:"tlsv1.1"]}, ...])
          - pattern: :ssl.connect($HOST, $PORT, [..., {:versions, [:sslv3]}, ...])
          - pattern: :ssl.connect($SOCK, [..., {:versions, [:tlsv1]}, ...], $TIMEOUT)
          - pattern: :ssl.connect($SOCK, [..., {:versions, [:"tlsv1.1"]}, ...], $TIMEOUT)
          - pattern: |
              $OPTS = [..., {:versions, [:tlsv1]}, ...]
          - pattern: |
              $OPTS = [..., {:versions, [:"tlsv1.1"]}, ...]
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [elixir]
    metadata:
      category: security
      technology: [elixir, erlang, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: elixir-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: :ssl.connect($HOST, $PORT, [..., {:verify, :verify_none}, ...])
          - pattern: :ssl.connect($SOCK, [..., {:verify, :verify_none}, ...], $TIMEOUT)
          - pattern: |
              $OPTS = [..., {:verify, :verify_none}, ...]
          - pattern: |
              $OPTS = [..., verify: :verify_none, ...]
    message: >-
      TLS certificate verification is disabled -- connections are vulnerable to MITM attacks. Always enable
      certificate validation.
    severity: ERROR
    languages: [elixir]
    metadata:
      category: security
      technology: [elixir, erlang, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: elixir-tls-weak-cipher-suite
    patterns:
      - pattern-either:
          - pattern: |
              $OPTS = [..., {:ciphers, [{:rc4_128, :sha, :rsa}]}, ...]
          - pattern: |
              $OPTS = [..., {:ciphers, [{:des_cbc, :sha, :rsa}]}, ...]
          - pattern: |
              $OPTS = [..., {:ciphers, [{:"3des_ede_cbc", :sha, :rsa}]}, ...]
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [elixir]
    metadata:
      category: security
      technology: [elixir, erlang, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8
