react-insecure-request.yaml

rules:
- id: react-insecure-request
  message: >-
    Unencrypted request over HTTP detected.
  metadata:
    vulnerability: Insecure Transport
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    references:
    - https://www.npmjs.com/package/axios
    category: security
    technology:
    - react
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages:
  - typescript
  - javascript
  severity: ERROR
  pattern-either:
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $AXIOS from 'axios';
          ...
          $AXIOS.$METHOD(...)
      - pattern-inside: |
          $AXIOS = require('axios');
          ...
          $AXIOS.$METHOD(...)
    - pattern-either:
      - pattern: $AXIOS.get("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.post("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.delete("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.head("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.patch("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.put("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
      - pattern: $AXIOS.options("=~/[Hh][Tt][Tt][Pp]:\/\/.*/",...)
  - patterns:
    - pattern-either:
      - pattern-inside: |
          import $AXIOS from 'axios';
          ...
          $AXIOS(...)
      - pattern-inside: |
          $AXIOS = require('axios');
          ...
          $AXIOS(...)
    - pattern-either:
      - pattern: '$AXIOS({url: "=~/[Hh][Tt][Tt][Pp]:\/\/.*/"}, ...)'
      - pattern: |
          $OPTS = {url: "=~/[Hh][Tt][Tt][Pp]:\/\/.*/"}
          ...
          $AXIOS($OPTS, ...)
  - pattern: fetch("=~/[Hh][Tt][Tt][Pp]:\/\/.*/", ...)