rules:
- id: socket-request
  message: >-
    Insecure transport rules to catch socket connections to http, telnet, and ftp servers.
    This is dangerous because these are protocols that do not encrypt traffic.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: LOW
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://docs.oracle.com/javase/8/docs/api/java/net/Socket.html
    subcategory:
    - audit
    technology:
    - java
    vulnerability: Insecure Transport
  languages:
  - java
  pattern-either:
  - pattern: |
      $SOCKET = new Socket("=~/[tT][eE][lL][nN][eE][tT]://.*/", ...);
      ...
      $OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
      ...
      $OUT.$FUNC(...);
  - pattern: |
      $SOCKET = new Socket("=~/^[fF][tT][pP]://.*/", ...);
      ...
      $OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
      ...
      $OUT.$FUNC(...);
  - pattern: |
      $SOCKET = new Socket("=~/[hH][tT][tT][pP]://.*/", ...);
      ...
      $OUT = new PrintWriter($SOCKET.getOutputStream(...), ...);
      ...
      $OUT.$FUNC(...);