rules:
  - id: java-tls-weak-version
    pattern-either:
      - pattern: SSLContext.getInstance("SSL")
      - pattern: SSLContext.getInstance("SSLv2")
      - pattern: SSLContext.getInstance("SSLv3")
      - pattern: SSLContext.getInstance("TLSv1")
      - pattern: SSLContext.getInstance("TLSv1.1")
    message: >-
      Weak or deprecated TLS version detected. TLS 1.0 and 1.1 are deprecated
      (RFC 8996). SSLv2/SSLv3 are completely broken. Use SSLContext.getInstance("TLS")
      and enforce TLSv1.3 via setEnabledProtocols(). TLS 1.3 is required for
      post-quantum cipher suite negotiation.
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_risk_score: 8

  - id: java-tls-rsa-static-key-exchange
    patterns:
      - pattern-either:
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_AES_128_CBC_SHA", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_AES_256_CBC_SHA", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_AES_128_GCM_SHA256", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_AES_256_GCM_SHA384", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_RC4_128_SHA", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "TLS_RSA_WITH_3DES_EDE_CBC_SHA", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "SSL_RSA_WITH_AES_128_CBC_SHA", ...})
          - pattern: $X.setEnabledCipherSuites(new String[]{..., "SSL_RSA_WITH_RC4_128_SHA", ...})
    message: >-
      QUANTUM VULNERABILITY: RSA static key exchange cipher suite detected. TLS_RSA_* suites
      use RSA for key transport (no forward secrecy) and are broken by Shor's algorithm.
      Replace with ECDHE suites (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) for immediate
      forward secrecy, or ML-KEM (FIPS 203) hybrid suites for full post-quantum protection.
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 9

  - id: java-jks-keystore-implicit-rsa
    pattern-either:
      - pattern: KeyStore.getInstance("JKS")
    message: >-
      JKS (Java KeyStore) format typically stores RSA private keys which are quantum-vulnerable
      via Shor's algorithm. Audit the key type stored in this keystore. Migrate to PKCS12
      format (KeyStore.getInstance("PKCS12")) and replace RSA keys with EC P-384 as an
      interim step, then ML-DSA (FIPS 204) for full post-quantum protection.
    severity: WARNING
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 6

  - id: java-tls-trust-all
    pattern-either:
      - pattern: |
          new X509TrustManager() {
            public void checkClientTrusted(...) {}
            public void checkServerTrusted(...) {}
            ...
          }
      - pattern: |
          new HostnameVerifier() {
            public boolean verify($HOST, $SESSION) { return true; }
          }
    message: >-
      Insecure TLS configuration: trust-all certificate manager or hostname
      verifier detected. This disables certificate validation entirely.
    severity: ERROR
    languages: [java]
    metadata:
      category: security
      cwe:
        - "CWE-295: Improper Certificate Validation"
      quantum_vulnerable: false
      quantum_risk_score: 8
