rules:
- id: ftp-request
  message: >-
    Checks for outgoing connections to ftp servers. FTP does not encrypt traffic, possibly
    leading to PII being sent plaintext over the network.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://www.codejava.net/java-se/ftp/connect-and-login-to-a-ftp-server
    - https://commons.apache.org/proper/commons-net/apidocs/org/apache/commons/net/ftp/FTPClient.html
    subcategory:
    - vuln
    technology:
    - java
    vulnerability: Insecure Transport
  languages:
  - java
  fix-regex:
    regex: '[fF][tT][pP]://'
    replacement: sftp://
    count: 1
  pattern-either:
  - pattern: |
      FTPClient $FTPCLIENT = new FTPClient();
      ...
      $FTPCLIENT.connect(...);
  - pattern: |
      URL $URL = new URL("=~/^[fF][tT][pP]://.*/");
      ...
      URLConnection $CONN = $URL.openConnection(...);