/**
 * Pass: tls-verify-disabled (CWE-295, category: security)
 *
 * Pattern pass — flags places where TLS certificate / hostname verification
 * is explicitly disabled. This is a *configuration* vulnerability (the bad
 * value is hard-coded, no taint flow is involved).
 *
 * Detection per language:
 *   Go:
 *     - `&tls.Config{InsecureSkipVerify: true}` (composite literal)
 *     - Detected via call argument scan: when the receiver is `tls` and
 *       call/composite contains literal `InsecureSkipVerify: true`, OR via
 *       a syntactic text scan (composite literals are not always emitted
 *       as calls in IR).
 *   Python:
 *     - `requests.get|post|put|delete|patch|head|options|request(..., verify=False)`
 *     - `ssl._create_unverified_context()` / `ssl._create_default_https_context = ssl._create_unverified_context`
 *     - `urllib3.disable_warnings(InsecureRequestWarning)` — best-effort hint
 *     - `httpx.Client(verify=False)` / `httpx.get(..., verify=False)`
 *   JavaScript / TypeScript:
 *     - `{ rejectUnauthorized: false }` in https.request / fetch options /
 *       node-fetch / axios — text scan on arg expressions
 *     - `https.Agent({ rejectUnauthorized: false })`
 *     - `process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'` (assignment;
 *       detected via call to property assignment — best-effort)
 *   Java:
 *     - Custom `HostnameVerifier` that returns true unconditionally
 *       (lambdas `(h, s) -> true` / anonymous classes) — detected via
 *       textual scan on setHostnameVerifier arg expression.
 *     - `setHostnameVerifier(NoopHostnameVerifier.INSTANCE)` /
 *       `setHostnameVerifier(new AllowAllHostnameVerifier())`
 *
 * Aligned with: gosec G402 (Go), Bandit B501/B502/B504/B505 (Python).
 */
import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
export interface TlsVerifyDisabledResult {
    findings: Array<{
        line: number;
        language: string;
        pattern: string;
        api: string;
    }>;
}
export declare class TlsVerifyDisabledPass implements AnalysisPass<TlsVerifyDisabledResult> {
    readonly name = "tls-verify-disabled";
    readonly category: "security";
    run(ctx: PassContext): TlsVerifyDisabledResult;
    private detectCall;
    private detectSourceText;
    private fixFor;
}
//# sourceMappingURL=tls-verify-disabled-pass.d.ts.map