rules:
- id: empty-aes-key
  message: >-
    Potential empty AES encryption key. Using an empty key in AES encryption
    can result in weak encryption and may allow attackers to easily decrypt sensitive
    data. Ensure that a strong, non-empty key is used for AES encryption.
  patterns:
  - pattern: AES.new("",...)
  languages:
  - python
  severity: WARNING
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    - 'CWE-310: Cryptographic Issues'
    references:
    - https://cwe.mitre.org/data/definitions/327.html
    - https://cwe.mitre.org/data/definitions/310.html
    category: security
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
    confidence: MEDIUM
    owasp: A6:2017 misconfiguration
    functional-categories:
    - crypto::search::key-length::pycrypto
    - crypto::search::key-length::pycryptodome
    technology:
    - python
    - pycrypto
    - pycryptodome