rules:
- id: http-components-request
  message: >-
    Checks for requests sent via Apache HTTP Components to http:// URLS. This is dangerous because
    the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead,
    send requests only to
    https:// URLS.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://hc.apache.org/httpcomponents-client-ga/quickstart.html
    subcategory:
    - vuln
    technology:
    - java
    vulnerability: Insecure Transport
  languages:
  - java
  fix-regex:
    regex: '[Hh][Tt][Tt][Pp]://'
    replacement: https://
    count: 1
  pattern-either:
  - pattern: |
      $HTTPCLIENT = HttpClients.$CREATE(...);
      ...
      $HTTPREQ = new $HTTPFUNC("=~/[hH][tT][tT][pP]://.*/");
      ...
      $RESPONSE = $HTTPCLIENT.execute($HTTPREQ);
  - pattern: |
      $HTTPCLIENT = HttpClients.$CREATE(...);
      ...
      $RESPONSE = $HTTPCLIENT.execute(new $HTTPFUNC("=~/[hH][tT][tT][pP]://.*/"));