rules:
- id: bypass-tls-verification
  message: >-
    Checks for disabling of TLS/SSL certificate verification.
    This should only be used for debugging purposes because it leads to vulnerability to MTM attacks.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://stackoverflow.com/questions/12122159/how-to-do-a-https-request-with-bad-certificate
    subcategory:
    - vuln
    technology:
    - go
    vulnerability: Insecure Transport
  languages: [go]
  pattern-either:
  - pattern: |
      tls.Config{..., InsecureSkipVerify: true, ...}
  - pattern: |
      $CONFIG = &tls.Config{...}
      ...
      $CONFIG.InsecureSkipVerify = true