rules:
- id: disallow-old-tls-versions1
  message: >-
    Detects direct creations of $HTTPS servers that don't disallow SSL v2, SSL v3, and TLS v1. These protocols
    are deprecated due to
    POODLE, man in the middle attacks, and other vulnerabilities.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://us-cert.cisa.gov/ncas/alerts/TA14-290A
    - https://stackoverflow.com/questions/40434934/how-to-disable-the-ssl-3-0-and-tls-1-0-in-nodejs
    - https://nodejs.org/api/https.html#https_https_createserver_options_requestlistener
    subcategory:
    - vuln
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages:
  - javascript
  - typescript
  patterns:
  - pattern-either:
    - pattern-inside: |
        $CONST = require('crypto');
        ...
    - pattern-inside: |
        $CONST = require('constants');
        ...
  - pattern-inside: |
      $HTTPS = require('https');
      ...
  - pattern: |
      $HTTPS.createServer(...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 }, ...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 }, ...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_SSLv3 |$CONST.SSL_OP_NO_TLSv1 }, ...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions: $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1 | $CONST.SSL_OP_NO_SSLv3}, ...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_SSLv2 |$CONST.SSL_OP_NO_TLSv1}, ...).$FUNC(...);
  - pattern-not: |
      $HTTPS.createServer({secureOptions:$CONST.SSL_OP_NO_SSLv3 | $CONST.SSL_OP_NO_TLSv1| $CONST.SSL_OP_NO_SSLv2}, ...).$FUNC(...);