rules:
- id: use-tls
  pattern: http.ListenAndServe($ADDR, $HANDLER)
  fix: http.ListenAndServeTLS($ADDR, certFile, keyFile, $HANDLER)
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    references:
    - https://golang.org/pkg/net/http/#ListenAndServeTLS
    category: security
    technology:
    - go
    confidence: MEDIUM
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead.
    See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.
  languages: [go]
  severity: WARNING