rules:
- id: ftp-request
  message: >-
    Checks for lack of usage of the "secure: true" option when sending ftp requests through the nodejs
    ftp module.
    This leads to unencrypted traffic being sent to the ftp server. There are other options
    such as "implicit" that still does not encrypt all traffic. ftp is the most utilized npm ftp module.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://www.npmjs.com/package/ftp
    - https://openbase.io/js/ftp
    subcategory:
    - vuln
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages:
  - javascript
  - typescript
  patterns:
  - pattern-inside: |
      $X = require('ftp');
      ...
      $C = new $X();
      ...
  - pattern-not-inside: |
      $OPTIONS = {secure: true};
      ...
  - pattern: |
      $C.connect($OPTIONS,...);
  - pattern-not: |
      $C.connect({...,secure: true});