rules:
- id: rest-http-client-support
  message: >-
    Checks for requests to http (unencrypted) sites using some of node js's most popular REST/HTTP libraries,
    including node-rest-client, axios, and got.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://www.npmjs.com/package/axios
    - https://www.npmjs.com/package/got
    - https://www.npmjs.com/package/node-rest-client
    subcategory:
    - vuln
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages: [javascript]
  patterns:
  - pattern-either:
    - pattern-inside: |
        $CLIENT = require('node-rest-client').Client;
        ...
        $C = new $CLIENT();
        ...
    - pattern-inside: |
        $C = require('axios');
        ...
    - pattern-inside: |
        $C = require('got');
        ...
  - pattern-either:
    - pattern: |
        $C.$REQ("=~/http://.*/", ...)
    - pattern: |
        $C("=~/http://.*/", ...)
    - pattern: |
        $C({...,url: "=~/http://.*/"})
    - pattern: |
        $C.$REQ({...,url: "=~/http://.*/"})