rules:
- id: bypass-tls-verification
  message: >-
    Checks for setting the environment variable NODE_TLS_REJECT_UNAUTHORIZED to 0, which disables TLS
    verification.
    This should only be used for debugging purposes. Setting the option rejectUnauthorized to false bypasses
    verification
    against the list of trusted CAs, which also leads to insecure transport. These options lead to vulnerability
    to MTM attacks, and should not be used.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://nodejs.org/api/https.html#https_https_request_options_callback
    - https://stackoverflow.com/questions/20433287/node-js-request-cert-has-expired#answer-29397100
    subcategory:
    - vuln
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages:
  - javascript
  - typescript
  pattern-either:
  - pattern: |
      process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
  - pattern: |
      {rejectUnauthorized:false}