rules:
- id: http-client-requests
  message: >-
    Checks for requests to http (unencrypted) sites using some of ruby's most popular REST/HTTP libraries,
    including httparty and restclient.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://github.com/rest-client/rest-client
    - https://github.com/jnunemaker/httparty/tree/master/docs
    subcategory:
    - vuln
    technology:
    - httparty
    - rest-client
    vulnerability: Insecure Transport
  languages:
  - ruby
  pattern-either:
  - pattern: |
      HTTParty.$PARTYVERB("=~/[hH][tT][tT][pP]://.*/", ...)
  - pattern: |
      $STRING = "=~/[hH][tT][tT][pP]://.*/"
      ...
      HTTParty.$PARTYVERB($STRING, ...)
  - pattern: |
      RestClient.$RESTVERB "=~/[hH][tT][tT][pP]://.*/", ...
  - pattern: |
      RestClient::Request.execute(..., url: "=~/[hH][tT][tT][pP]://.*/", ...)