rules:
  # Vue applications -- crypto vulnerabilities in Vue component logic (.js/.ts files).
  # Note: opengrep dropped Vue SFC (.vue) parser support at 1.93.0. These rules use
  # languages: [javascript, typescript] to cover .js/.ts files in Vue projects
  # (composables, stores, services, utils). The patterns are identical to what would
  # appear inside <script> / <script setup> blocks.

  - id: vue-use-of-md5-quantum
    patterns:
      - pattern-either:
          - pattern: crypto.createHash('md5')
          - pattern: crypto.createHash("md5")
          - pattern: CryptoJS.MD5(...)
          - pattern: md5(...)
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: vue-use-of-sha1-quantum
    patterns:
      - pattern-either:
          - pattern: crypto.createHash('sha1')
          - pattern: crypto.createHash("sha1")
          - pattern: CryptoJS.SHA1(...)
          - pattern: window.crypto.subtle.digest('SHA-1', ...)
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: vue-use-of-des-rc4-quantum
    patterns:
      - pattern-either:
          - pattern: CryptoJS.DES.encrypt(...)
          - pattern: CryptoJS.DES.decrypt(...)
          - pattern: CryptoJS.TripleDES.encrypt(...)
          - pattern: CryptoJS.TripleDES.decrypt(...)
          - pattern: CryptoJS.RC4.encrypt(...)
          - pattern: CryptoJS.RC4.decrypt(...)
          - pattern: crypto.createCipheriv('des', ...)
          - pattern: crypto.createCipheriv("des", ...)
          - pattern: crypto.createCipheriv('rc4', ...)
          - pattern: crypto.createCipheriv("rc4", ...)
    message: >-
      3DES has 112-bit effective key strength -- broken classically and quantum-vulnerable. NIST deprecated
      3DES in 2023. Migrate to AES-256-GCM.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: vue-use-of-rsa-ec-quantum
    patterns:
      - pattern-either:
          - pattern: |
              window.crypto.subtle.generateKey({name: "RSA-OAEP", ...}, ...)
          - pattern: |
              window.crypto.subtle.generateKey({name: "RSASSA-PKCS1-v1_5", ...}, ...)
          - pattern: |
              window.crypto.subtle.generateKey({name: "RSA-PSS", ...}, ...)
          - pattern: |
              window.crypto.subtle.generateKey({name: "ECDSA", ...}, ...)
          - pattern: |
              window.crypto.subtle.generateKey({name: "ECDH", ...}, ...)
          - pattern: |
              crypto.subtle.generateKey({name: "RSA-OAEP", ...}, ...)
          - pattern: |
              crypto.subtle.generateKey({name: "ECDSA", ...}, ...)
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript, webcrypto, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: CRITICAL
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: vue-weak-random-quantum
    patterns:
      - pattern: Math.random()
    message: >-
      Non-cryptographic PRNG used for security-sensitive operations -- output is predictable. Use a
      cryptographically secure random number generator.
    severity: WARNING
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript]
      cwe:
        - "CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: false
      quantum_risk_score: 7

  - id: vue-hardcoded-crypto-key
    patterns:
      - pattern-either:
          - pattern: CryptoJS.AES.encrypt($DATA, '...')
          - pattern: CryptoJS.AES.encrypt($DATA, "...")
          - pattern: CryptoJS.AES.decrypt($DATA, '...')
          - pattern: CryptoJS.AES.decrypt($DATA, "...")
          - pattern: CryptoJS.DES.encrypt($DATA, '...')
          - pattern: CryptoJS.DES.encrypt($DATA, "...")
    message: >-
      CRYPTOGRAPHIC VULNERABILITY: Hard-coded cryptographic key detected in Vue component. Keys embedded
      in frontend code are trivially extractable by anyone who can read the JavaScript bundle.
    severity: ERROR
    languages: [javascript, typescript]
    metadata:
      category: security
      technology: [vue, javascript]
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9
