rules:
- id: http-request
  message: >-
    Checks for requests sent to http:// URLs. This is dangerous as the server is attempting to connect
    to a website
    that does not encrypt traffic with TLS. Instead, only send requests to https:// URLs.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://nodejs.org/api/http.html#http_http_request_options_callback
    subcategory:
    - vuln
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages:
  - javascript
  patterns:
  - pattern-inside: |
      $HTTP = require('http');
      ...
  - pattern-either:
    - pattern: |
        $HTTP.request("=~/http://.*/",...);
    - pattern: |
        $HTTP.get("=~/http://.*/", ...)
    - pattern: |
        $VAR = new URL("=~/http://.*/");
        ...
        $HTTP.request($VAR, ...);
    - pattern: |
        $VAR = {...,hostname: "..."};
        ...
        $HTTP.request(..., $VAR, ...);
    - pattern: |
        $HTTP.request(..., {...,hostname: "..."}, ...);
  - pattern-not: |
      $VAR = {...,protocol: "https"};
      ...
      $HTTP.request(..., $VAR, ...);
  - pattern-not: |
      $HTTP.request(..., {...,protocol: "https"}, ...);