rules:
  - id: php-weak-rsa-key-size
    patterns:
      - pattern-either:
          - pattern: openssl_pkey_new(array("private_key_bits" => $SIZE, ...))
          - pattern: openssl_pkey_new(['private_key_bits' => $SIZE, ...])
      - metavariable-comparison:
          metavariable: $SIZE
          comparison: $SIZE < 2048
    message: >-
      Weak RSA key size detected ($SIZE bits). RSA keys smaller than 2048 bits
      are vulnerable to quantum attacks. Use minimum 2048 bits, preferably 3072+ bits.
    severity: ERROR
    languages:
      - php
    metadata:
      quantum_vulnerable: true
      cwe: "CWE-326"
