rules:
- id: ftp-request
  message: >-
    Checks for outgoing connections to ftp servers with the ftp package. FTP does not encrypt traffic,
    possibly
    leading to PII being sent plaintext over the network. Instead, connect via the SFTP protocol.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://godoc.org/github.com/jlaffaye/ftp#Dial
    - https://github.com/jlaffaye/ftp
    subcategory:
    - vuln
    technology:
    - ftp
    vulnerability: Insecure Transport
  languages:
  - go
  fix-regex:
    regex: '[fF][tT][pP]://'
    replacement: sftp://
    count: 1
  pattern-either:
  - pattern: |
      ftp.Dial("=~/^[fF][tT][pP]://.*/", ...)
  - pattern: |
      ftp.DialTimeout("=~/^[fF][tT][pP]://.*/", ...)
  - pattern: |
      ftp.Connect("=~/^[fF][tT][pP]://.*/")
  - pattern: |
      $URL = "=~/^[fF][tT][pP]://.*/"
      ...
      ftp.Dial($URL, ...)
  - pattern: |
      $URL = "=~/^[fF][tT][pP]://.*/"
      ...
      ftp.DialTimeout($URL, ...)
  - pattern: |
      $URL = "=~/^[fF][tT][pP]://.*/"
      ...
      ftp.Connect($URL)