rules:
  - id: typescript-weak-symmetric-cipher
    pattern-either:
      - pattern: crypto.createCipheriv('aes-128-cbc', ...)
      - pattern: crypto.createCipheriv('aes-128-ecb', ...)
      - pattern: crypto.createCipheriv('aes-128-gcm', ...)
      - pattern: crypto.createCipheriv('aes-128-cfb', ...)
      - pattern: crypto.createCipheriv('aes-128-ofb', ...)
      - pattern: crypto.createCipher('aes-128-cbc', ...)
      - pattern: crypto.createCipher('aes-128-ecb', ...)
      - pattern: crypto.createCipher('aes-128-gcm', ...)
      - pattern: crypto.createCipher('aes-128-cfb', ...)
      - pattern: crypto.createCipher('aes-128-ofb', ...)
      - pattern: crypto.createCipheriv('aes-192-cbc', ...)
      - pattern: crypto.createCipheriv('aes-192-ecb', ...)
      - pattern: crypto.createCipheriv('aes-192-gcm', ...)
      - pattern: crypto.createCipheriv('aes-192-cfb', ...)
      - pattern: crypto.createCipheriv('aes-192-ofb', ...)
      - pattern: crypto.createCipher('aes-192-cbc', ...)
      - pattern: crypto.createCipher('aes-192-ecb', ...)
      - pattern: crypto.createCipher('aes-192-gcm', ...)
      - pattern: crypto.createCipher('aes-192-cfb', ...)
      - pattern: crypto.createCipher('aes-192-ofb', ...)
      - pattern: crypto.createCipheriv('des', ...)
      - pattern: crypto.createCipheriv('des-ecb', ...)
      - pattern: crypto.createCipheriv('des-cbc', ...)
      - pattern: crypto.createCipheriv('des-ede', ...)
      - pattern: crypto.createCipheriv('des-ede-cbc', ...)
      - pattern: crypto.createCipheriv('des-ede3', ...)
      - pattern: crypto.createCipheriv('des-ede3-cbc', ...)
      - pattern: crypto.createCipheriv('des3', ...)
      - pattern: crypto.createCipheriv('rc4', ...)
      - pattern: crypto.createCipher('des', ...)
      - pattern: crypto.createCipher('des-ecb', ...)
      - pattern: crypto.createCipher('des-cbc', ...)
      - pattern: crypto.createCipher('des-ede', ...)
      - pattern: crypto.createCipher('des-ede-cbc', ...)
      - pattern: crypto.createCipher('des-ede3', ...)
      - pattern: crypto.createCipher('des-ede3-cbc', ...)
      - pattern: crypto.createCipher('des3', ...)
      - pattern: crypto.createCipher('rc4', ...)
      - pattern: crypto.createDecipheriv('des', ...)
      - pattern: crypto.createDecipheriv('des-ecb', ...)
      - pattern: crypto.createDecipheriv('des-cbc', ...)
      - pattern: crypto.createDecipheriv('des-ede', ...)
      - pattern: crypto.createDecipheriv('des-ede-cbc', ...)
      - pattern: crypto.createDecipheriv('des-ede3', ...)
      - pattern: crypto.createDecipheriv('des-ede3-cbc', ...)
      - pattern: crypto.createDecipheriv('des3', ...)
      - pattern: crypto.createDecipheriv('rc4', ...)
    message: >-
      QUANTUM VULNERABILITY: AES-128/192 provide only 64/96-bit quantum security
      via Grover's algorithm. DES/3DES/RC4 are classically broken and quantum-vulnerable.
      Use AES-256 for quantum resistance.
    severity: WARNING
    languages:
      - typescript
    metadata:
      category: security
      quantum_vulnerable: true
      quantum_risk_score: 75
