rules:
- id: spring-ftp-request
  message: >-
    Checks for outgoing connections to ftp servers via Spring plugin ftpSessionFactory. FTP does not encrypt
    traffic, possibly
    leading to PII being sent plaintext over the network.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://docs.spring.io/spring-integration/api/org/springframework/integration/ftp/session/AbstractFtpSessionFactory.html#setClientMode-int-
    subcategory:
    - vuln
    technology:
    - spring
    vulnerability: Insecure Transport
  languages:
  - java
  fix-regex:
    regex: '[fF][tT][pP]://'
    replacement: sftp://
    count: 1
  pattern-either:
  - pattern: |
      $SF = new DefaultFtpSessionFactory(...);
      ...
      $SF.setHost("=~/^[fF][tT][pP]://.*/");
      ...
      $SF.$FUNC(...);
  - pattern: |
      $SF = new DefaultFtpSessionFactory(...);
      ...
      String $URL = "=~/^[fF][tT][pP]://.*/";
      ...
      $SF.setHost($URL);
      ...
      $SF.$FUNC(...);