rules:
  - id: dart-tls-cert-validation-disabled
    patterns:
      - pattern-regex: "badCertificateCallback\\s*=\\s*\\([^)]*\\)\\s*=>\\s*true"
    message: >-
      SECURITY VULNERABILITY: TLS certificate validation is disabled via a
      badCertificateCallback that unconditionally returns true. This allows
      man-in-the-middle attacks and completely defeats TLS security.
    severity: ERROR
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, tls]
      cwe:
        - "CWE-295: Improper Certificate Validation"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: HIGH
      impact: CRITICAL
      quantum_vulnerable: false
      quantum_risk_score: 9

  - id: dart-http-not-https
    patterns:
      - pattern-regex: "['\"]http://"
    message: >-
      Insecure HTTP URL detected -- traffic is unencrypted and vulnerable to
      interception and tampering. Use https:// instead.
    severity: WARNING
    languages: [generic]
    metadata:
      category: security
      technology: [dart, flutter, tls]
      cwe:
        - "CWE-319: Cleartext Transmission of Sensitive Information"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: MEDIUM
      quantum_vulnerable: false
      quantum_risk_score: 5
