rules:
  - id: go-tls-insecure-skip-verify
    pattern-either:
      - pattern: |
          &tls.Config{InsecureSkipVerify: true, ...}
      - pattern: |
          tls.Config{InsecureSkipVerify: true, ...}
    message: >-
      InsecureSkipVerify disables TLS certificate validation entirely.
      This makes connections vulnerable to MITM attacks.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-295: Improper Certificate Validation"
      quantum_vulnerable: false
      quantum_risk_score: 8

  - id: go-tls-weak-min-version
    pattern-either:
      - pattern: |
          &tls.Config{MinVersion: tls.VersionTLS10, ...}
      - pattern: |
          &tls.Config{MinVersion: tls.VersionTLS11, ...}
      - pattern: |
          &tls.Config{MinVersion: tls.VersionSSL30, ...}
    message: >-
      Weak TLS minimum version detected. TLS 1.0 and 1.1 are deprecated (RFC 8996).
      Use tls.VersionTLS13 for post-quantum cipher suite support.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      cwe:
        - "CWE-326: Inadequate Encryption Strength"
      quantum_vulnerable: true
      quantum_risk_score: 8

  - id: go-tls-rsa-static-cipher-suite
    pattern-either:
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_AES_128_CBC_SHA, ...}, ...}
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_AES_256_CBC_SHA, ...}, ...}
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_AES_128_GCM_SHA256, ...}, ...}
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_AES_256_GCM_SHA384, ...}, ...}
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, ...}, ...}
      - pattern: |
          &tls.Config{..., CipherSuites: []uint16{..., tls.TLS_RSA_WITH_RC4_128_SHA, ...}, ...}
    message: >-
      QUANTUM VULNERABILITY: RSA static key exchange cipher suite in tls.Config.CipherSuites.
      TLS_RSA_* suites use RSA for key transport with no forward secrecy and are broken by
      Shor's algorithm. Remove TLS_RSA_* entries and prefer ECDHE-based suites, or upgrade
      to TLS 1.3 (tls.VersionTLS13) which mandates forward secrecy and supports PQC hybrids.
    severity: ERROR
    languages: [go]
    metadata:
      category: security
      technology: [go, tls, post-quantum]
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
        - "CWE-326: Inadequate Encryption Strength"
      owasp:
        - A02:2021 - Cryptographic Failures
      confidence: HIGH
      likelihood: MEDIUM
      impact: HIGH
      quantum_vulnerable: true
      quantum_attack: "Shor's Algorithm"
      quantum_risk_score: 9
