rules:
  - id: php-tls-version-too-old
    patterns:
      - pattern-either:
          - pattern: openssl_set_min_proto_version($CTX, OPENSSL_PROTO_TLSv1)
          - pattern: openssl_set_min_proto_version($CTX, OPENSSL_PROTO_SSLv3)
          - pattern: curl_setopt($CH, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_0)
          - pattern: curl_setopt($CH, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_1)
          - pattern: curl_setopt($CH, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv3)
          - pattern: curl_setopt($CH, CURLOPT_SSLVERSION, CURL_SSLVERSION_SSLv2)
          - pattern: stream_context_create(["ssl" => [..., "crypto_method" => STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT, ...]])
          - pattern: stream_context_create(["ssl" => [..., "crypto_method" => STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT, ...]])
    message: >-
      TLS 1.0/1.1 use broken cipher suites (RC4, 3DES, EXPORT) and are prohibited by RFC 8996. Upgrade to
      TLS 1.3.
    severity: ERROR
    languages: [php]
    metadata:
      category: security
      technology: [php, tls, post-quantum]
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: php-tls-cert-validation-disabled
    patterns:
      - pattern-either:
          - pattern: curl_setopt($CH, CURLOPT_SSL_VERIFYPEER, false)
          - pattern: curl_setopt($CH, CURLOPT_SSL_VERIFYPEER, 0)
          - pattern: curl_setopt($CH, CURLOPT_SSL_VERIFYHOST, false)
          - pattern: curl_setopt($CH, CURLOPT_SSL_VERIFYHOST, 0)
          - pattern: stream_context_create(["ssl" => [..., "verify_peer" => false, ...]])
          - pattern: stream_context_create(["ssl" => [..., "verify_peer_name" => false, ...]])
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled. This allows man-in-the-middle
      attacks and completely defeats TLS security.
    severity: ERROR
    languages: [php]
    metadata:
      category: security
      technology: [php, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: php-tls-weak-cipher-suite
    patterns:
      - pattern-either:
          - pattern: curl_setopt($CH, CURLOPT_SSL_CIPHER_LIST, "RC4-SHA:...")
          - pattern: curl_setopt($CH, CURLOPT_SSL_CIPHER_LIST, "DES-CBC-SHA:...")
          - pattern: curl_setopt($CH, CURLOPT_SSL_CIPHER_LIST, "NULL-SHA:...")
          - pattern: curl_setopt($CH, CURLOPT_SSL_CIPHER_LIST, "aNULL:...")
    message: >-
      Explicit weak cipher suite configuration bypasses secure TLS defaults. Use TLS 1.3 which negotiates
      cipher suites automatically.
    severity: ERROR
    languages: [php]
    metadata:
      category: security
      technology: [php, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Blocks PQC migration"
      quantum_risk_score: 8

  - id: php-tls-rsa-static-key-exchange
    patterns:
      - pattern-either:
          - pattern: curl_setopt($CH, CURLOPT_SSL_CIPHER_LIST, $CIPHER)
          - pattern: stream_context_create(["ssl" => [..., "ciphers" => $CIPHER, ...]])
      - metavariable-regex:
          metavariable: $CIPHER
          regex: ".*(TLS_RSA_WITH_|AES128-SHA|AES256-SHA|AES128-SHA256|AES256-SHA256|AES128-GCM-SHA256|AES256-GCM-SHA384|kRSA).*"
    message: >-
      QUANTUM VULNERABILITY: RSA static key exchange cipher suite detected. OpenSSL names
      AES128-SHA, AES256-SHA, AES*-GCM-* (without ECDHE prefix), and selectors kRSA/RSA
      all use static RSA key transport with no forward secrecy, broken by Shor's algorithm.
      Use ECDHE suites (ECDHE-RSA-AES256-GCM-SHA384) via CURLOPT_SSL_CIPHER_LIST or migrate
      to TLS 1.3 (CURL_SSLVERSION_TLSv1_3) which mandates forward secrecy.
    severity: ERROR
    languages: [php]
    metadata:
      category: security
      technology: [php, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 9
