curl-unencrypted-url.yaml

rules:
  - id: curl-unencrypted-url
    message: Found `curl` command with unencrypted URL (e.g. HTTP, FTP, etc.)
    languages: [generic]
    severity: WARNING
    metadata:
      category: security
      subcategory: [audit]
      technology: [shell]
      cwe: "CWE-319: Cleartext Transmission of Sensitive Information"
      confidence: MEDIUM
      likelihood: MEDIUM
      impact: HIGH
      references:
        - https://curl.se/docs/manpage.html
    patterns:
      - pattern-either:
          - pattern: curl ... http://
          - pattern: curl ... ftp://
      - pattern-not-inside: curl ... http://127.0.0.1
      - pattern-not-inside: curl ... http://localhost