rules:
  - id: rust-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: SslMethod::tls()
          - pattern: SslMethod::sslv3()
          - pattern: SslMethod::tlsv1()
          - pattern: SslMethod::tlsv1_1()
          - pattern: $BUILDER.set_max_proto_version(Some(SslVersion::TLS1))
          - pattern: $BUILDER.set_max_proto_version(Some(SslVersion::TLS1_1))
          - pattern: $BUILDER.set_max_proto_version(Some(SslVersion::SSL3))
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      technology: [rust, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: rust-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: $BUILDER.set_verify(SslVerifyMode::NONE)
          - pattern: TlsConnector::builder().danger_accept_invalid_certs(true)
          - pattern: $BUILDER.danger_accept_invalid_certs(true)
          - pattern: $BUILDER.danger_accept_invalid_hostnames(true)
          - pattern: ClientConfig::builder().with_root_certificates($STORE).with_no_client_auth()
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled. This allows man-in-the-middle
      attacks and completely defeats TLS security.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      technology: [rust, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: rust-tls-weak-cipher-suite
    patterns:
      - pattern-either:
          - pattern: $BUILDER.set_cipher_list("RC4-SHA:...")
          - pattern: $BUILDER.set_cipher_list("DES-CBC-SHA:...")
          - pattern: $BUILDER.set_cipher_list("NULL-SHA:...")
          - pattern: $BUILDER.set_cipher_list("aNULL:...")
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [rust]
    metadata:
      category: security
      technology: [rust, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8
