rules:
  - id: java-tls-weak-version
    pattern-either:
      - pattern: SSLContext.getInstance("SSL")
      - pattern: SSLContext.getInstance("SSLv2")
      - pattern: SSLContext.getInstance("SSLv3")
      - pattern: SSLContext.getInstance("TLS")
      - pattern: SSLContext.getInstance("TLSv1")
      - pattern: SSLContext.getInstance("TLSv1.1")
    message: >-
      Weak or deprecated TLS version detected. TLS 1.0 and 1.1 are deprecated
      (RFC 8996). SSLv2/SSLv3 are completely broken. Use TLSv1.3 or TLSv1.2
      at minimum. TLS 1.3 is required for post-quantum cipher suite negotiation.
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_risk_score: 8

  - id: java-tls-trust-all
    pattern-either:
      - pattern: |
          new X509TrustManager() {
            public void checkClientTrusted(...) {}
            public void checkServerTrusted(...) {}
            ...
          }
      - pattern: |
          new HostnameVerifier() {
            public boolean verify($HOST, $SESSION) { return true; }
          }
    message: >-
      Insecure TLS configuration: trust-all certificate manager or hostname
      verifier detected. This disables certificate validation entirely.
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-295: Improper Certificate Validation"
      quantum_vulnerable: false
      quantum_risk_score: 8
