rules:
- id: cookie-missing-secure-flag
  metadata:
    cwe:
    - "CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute"
    owasp:
    - A05:2021 - Security Misconfiguration
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_COOKIE
    category: security
    technology:
    - kt
    references:
    - https://owasp.org/Top10/A05_2021-Security_Misconfiguration
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  message: >-
    A cookie was detected without setting the 'secure' flag. The 'secure' flag
    for cookies prevents the client from transmitting the cookie over insecure
    channels such as HTTP. Set the 'secure' flag by calling '$COOKIE.setSecure(true);'
  severity: WARNING
  languages: [kt]
  patterns:
  - pattern-not-inside: |
      $COOKIE.setValue("")
      ...
  - pattern-either:
    - pattern: $COOKIE.setSecure(false)
    - patterns:
      - pattern-not-inside: |
          $COOKIE.setSecure(...)
          ...
      - pattern: $RESPONSE.addCookie($COOKIE)