rules:
- id: using-http-server
  message: >-
    Checks for any usage of http servers instead of https servers. Encourages the usage of https protocol
    instead of
    http, which does not have TLS and is therefore unencrypted. Using http can lead to man-in-the-middle
    attacks
    in which the attacker is able to read sensitive information.
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A03:2017 - Sensitive Data Exposure
    references:
    - https://nodejs.org/api/http.html#http_class_http_agent
    - https://groups.google.com/g/rubyonrails-security/c/NCCsca7TEtY
    subcategory:
    - audit
    technology:
    - node.js
    vulnerability: Insecure Transport
  languages:
  - javascript
  patterns:
  - pattern-inside: |
      $HTTP = require('http');
      ...
  - pattern-either:
    - pattern: |
        $HTTP.$FUNC(...);
    - pattern: |
        new $HTTP.$FUNC2(...);
  - pattern: $HTTP