rules:
- id: disallow-old-tls-versions1
  message: >-
    Detects direct creations of SSLConnectionSocketFactories that don't disallow SSL v2, SSL v3, and TLS
    v1.
    SSLSocketFactory can be used to validate the identity of the HTTPS server against a list of trusted
    certificates.
    These protocols are deprecated due to POODLE, man in the middle attacks, and other vulnerabilities.
  severity: WARNING
  metadata:
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://stackoverflow.com/questions/26429751/java-http-clients-and-poodle
    subcategory:
    - vuln
    technology:
    - java
    vulnerability: Insecure Transport
  languages: [java]
  patterns:
  - pattern: |
      new SSLConnectionSocketFactory(...);
  - pattern-not: |
      new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2", "TLSv1.3"}, ...);
  - pattern-not: |
      new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3", "TLSv1.2"}, ...);
  - pattern-not: |
      new SSLConnectionSocketFactory(..., new String[] {"TLSv1.3"}, ...);
  - pattern-not: |
      new SSLConnectionSocketFactory(..., new String[] {"TLSv1.2"}, ...);
  - pattern-not-inside: >
      (SSLConnectionSocketFactory $SF) = new
      SSLConnectionSocketFactory(...);
      ...
      (TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_2). ... .build();
      ...
      HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();
  - pattern-not-inside: >
      (SSLConnectionSocketFactory $SF) = new
      SSLConnectionSocketFactory(...);
      ...
      (TlsConfig $TLSCONFIG) = TlsConfig.custom(). ... .setSupportedProtocols(TLS.V_1_3). ... .build();
      ...
      HttpClientConnectionManager cm = $CM.create(). ... .setSSLSocketFactory($SF). ... .setDefaultTlsConfig($TLSCONFIG). ... .build();