rules:
  - id: auth.rust.tls.accept-invalid-certs
    languages:
      - rust
    severity: ERROR
    message: |
      A reqwest client is built with `danger_accept_invalid_certs(true)`, which
      turns off TLS certificate validation. Any attacker who can intercept the
      connection can present any certificate and read or tamper with the
      traffic, a man-in-the-middle hole. For OAuth/OIDC this leaks
      authorization codes, access tokens, and client secrets in transit.

      Never accept invalid certificates. Leave validation on (the default). To
      trust a private CA in development, add it explicitly with
      `ClientBuilder::add_root_certificate(cert)` instead.
    # Matches only the literal `true`. `danger_accept_invalid_certs(false)` and
    # the method's absence are not flagged. `$B` is any builder expression.
    pattern: $B.danger_accept_invalid_certs(true)
    # Safe, deterministic autofix: flip the boolean literal to `false`, which is
    # the secure default and fully resolves the finding. `$B` (the builder
    # expression) is preserved verbatim, so the surrounding chain is untouched:
    # only `true` -> `false` changes.
    fix: $B.danger_accept_invalid_certs(false)
    metadata:
      oauthlint-rule-id: AUTH-RUST-TLS-001
      oauthlint-doc-url: https://oauthlint.dev/rules/rust-tls-accept-invalid-certs
      category: security
      cwe: CWE-295
      owasp: A02:2021
      llm-prevalence: HIGH
      technology:
        - reqwest
      references:
        - https://docs.rs/reqwest/latest/reqwest/struct.ClientBuilder.html#method.danger_accept_invalid_certs
        - https://cwe.mitre.org/data/definitions/295.html