rules:
  - id: python-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: ssl.wrap_socket(..., ssl_version=ssl.PROTOCOL_TLSv1, ...)
          - pattern: ssl.wrap_socket(..., ssl_version=ssl.PROTOCOL_TLSv1_1, ...)
          - pattern: ssl.SSLContext(ssl.PROTOCOL_TLSv1)
          - pattern: ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
          - pattern: ssl.SSLContext(ssl.PROTOCOL_SSLv2)
          - pattern: ssl.SSLContext(ssl.PROTOCOL_SSLv3)
          - pattern: $CTX.minimum_version = ssl.TLSVersion.TLSv1
          - pattern: $CTX.minimum_version = ssl.TLSVersion.TLSv1_1
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [python]
    metadata:
      category: security
      technology: [python, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: python-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: requests.get(..., verify=False, ...)
          - pattern: requests.post(..., verify=False, ...)
          - pattern: requests.put(..., verify=False, ...)
          - pattern: requests.patch(..., verify=False, ...)
          - pattern: requests.delete(..., verify=False, ...)
          - pattern: requests.request(..., verify=False, ...)
          - pattern: requests.Session().verify = False
          - pattern: $SESSION.verify = False
          - pattern: $CTX.check_hostname = False
          - pattern: $CTX.verify_mode = ssl.CERT_NONE
          - pattern: urllib3.disable_warnings(...)
          - pattern: httpx.Client(verify=False, ...)
          - pattern: aiohttp.ClientSession(connector=aiohttp.TCPConnector(ssl=False, ...))
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled. This allows man-in-the-middle
      attacks and completely defeats TLS security. Post-quantum cryptography cannot protect against MITM
      when certificate validation is off.
    severity: ERROR
    languages: [python]
    metadata:
      category: security
      technology: [python, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: python-tls-weak-cipher-suite
    patterns:
      - pattern-either:
          - pattern: $CTX.set_ciphers("RC4-SHA")
          - pattern: $CTX.set_ciphers("RC4-MD5")
          - pattern: $CTX.set_ciphers("DES-CBC-SHA")
          - pattern: $CTX.set_ciphers("NULL-SHA")
          - pattern: $CTX.set_ciphers("EXP-...")
          - pattern: $CTX.set_ciphers("aNULL:...")
          - pattern: $CTX.set_ciphers("eNULL:...")
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [python]
    metadata:
      category: security
      technology: [python, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8
