# ============================================================
# Quantum Cryptography Vulnerability Rules -- Julia Language
# ============================================================
# Language: Julia
# Rule format: pattern-regex (NOT pattern: or patterns:)
#
# Why pattern-regex:
#   opengrep does not have a mature, stable AST parser for Julia.
#   Julia's multiple-dispatch function call syntax and module
#   qualification patterns (e.g., Nettle.md5(...), MbedTLS.DES(key))
#   are not reliably parsed by generic AST matchers. Using
#   pattern-regex provides consistent, version-independent detection
#   against raw Julia source text.
#
# Approach:
#   Rules target Julia's primary cryptographic libraries: Nettle.jl
#   and MbedTLS.jl, which are the dominant crypto packages in the
#   Julia ecosystem. Each pattern matches both module-qualified
#   (Nettle.md5) and unqualified (md5) call forms to ensure coverage
#   regardless of how the package namespace was imported.
# ============================================================

rules:
  - id: julia-use-of-md5-quantum
    pattern-regex: "(?:md5\\s*\\(|MD5\\s*\\(|Nettle\\.(?:md5|MD5)|MbedTLS\\.MD5)"
    message: >-
      MD5 is cryptographically broken and quantum-weakened by Grover's algorithm -- effective security
      drops from 128 to 64 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: julia-use-of-sha1-quantum
    pattern-regex: "(?:sha1\\s*\\(|SHA1\\s*\\(|Nettle\\.(?:sha1|SHA1)|MbedTLS\\.SHA1)"
    message: >-
      SHA-1 is deprecated and quantum-weakened by Grover's algorithm -- effective security drops from 160
      to 80 bits. Use SHA-256, SHA-384, or SHA-3.
    severity: ERROR
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-328: Use of Weak Hash"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: julia-use-of-rsa-quantum
    pattern-regex: "(?:MbedTLS\\.RSA|OpenSSL\\.rsa_generate_key|Nettle\\.RSA|rsa_keygen\\s*\\()"
    message: >-
      RSA key size $SIZE bits is too small and quantum-vulnerable. RSA is broken by Shor's algorithm
      regardless of key size. Migrate to ML-KEM (FIPS 203) for key encapsulation or ML-DSA (FIPS 204) for
      signatures.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: julia-use-of-des-quantum
    pattern-regex: "(?:MbedTLS\\.DES\\b|Nettle\\.des\\s*\\()"
    message: >-
      DES has a 56-bit key -- completely broken classically and trivially quantum-vulnerable. Migrate to
      AES-256-GCM.
    severity: ERROR
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 10

  - id: julia-weak-rsa-key-size
    pattern-regex: "rsa_keygen\\s*\\(\\s*(?:512|1024|2048)\\s*\\)"
    message: >-
      RSA is broken by Shor's algorithm regardless of key size. Migrate to ML-KEM (FIPS 203) for key
      encapsulation or ML-DSA (FIPS 204) for signatures.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: julia-use-of-ecc-quantum
    pattern-regex: "(?:OpenSSL\\.ec_generate_key|MbedTLS\\.ECPoint|MbedTLS\\.ECDSA|Nettle\\.ec_)"
    message: >-
      ECC (ECDSA/ECDH) is broken by Shor's algorithm -- all curves (P-256, P-384, secp256k1, Curve25519)
      are equally vulnerable regardless of key size. Migrate: ECDSA  ML-DSA (FIPS 204)  ECDH  ML-KEM
      (FIPS 203).
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: julia-use-of-dh-quantum
    pattern-regex: "(?:OpenSSL\\.dh_generate_parameters|MbedTLS\\.DHParams|Nettle\\.dh_)"
    message: >-
      DH/DSA is broken by Shor's algorithm. Migrate to ML-KEM (FIPS 203) for key exchange or ML-DSA (FIPS
      204) for signatures.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: julia-use-of-dsa-quantum
    pattern-regex: "(?:OpenSSL\\.dsa_generate_key|MbedTLS\\.DSA|Nettle\\.dsa_)"
    message: >-
      QUANTUM VULNERABILITY: DSA key generation detected. Shor's algorithm breaks DSA by solving the
      discrete logarithm problem.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 8

  - id: julia-use-of-rc4-quantum
    pattern-regex: "(?:MbedTLS\\.RC4\\b|Nettle\\.rc4\\s*\\()"
    message: >-
      RC4 is completely broken and banned by RFC 7465. Migrate to AES-256-GCM or ChaCha20-Poly1305.
    severity: ERROR
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-327: Use of a Broken or Risky Cryptographic Algorithm"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 9

  - id: julia-use-of-aes128-quantum
    pattern-regex: "MbedTLS\\.AES\\s*\\([^,]+,\\s*[^,]+,\\s*128\\s*\\)"
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-326: Inadequate Encryption Strength"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 7

  - id: julia-use-of-aes192-quantum
    pattern-regex: "MbedTLS\\.AES\\s*\\([^,]+,\\s*[^,]+,\\s*192\\s*\\)"
    message: >-
      AES-128/192 provide only 64/96-bit quantum security under Grover's algorithm. Use AES-256 for
      128-bit post-quantum security.
    severity: WARNING
    languages: [julia]
    metadata:
      category: security
      technology: [julia, post-quantum]
      cwe: ["CWE-326: Inadequate Encryption Strength"]
      owasp: ["A02:2021 - Cryptographic Failures"]
      quantum_vulnerable: true
      quantum_attack: "Grover's Algorithm"
      quantum_risk_score: 6
