rules:
- id: weak-random
  message: >-
    Detected use of the functions `Math.random()` or `java.util.Random()`. These are both not
    cryptographically strong random number generators (RNGs). If you are using these
    RNGs to create passwords or secret tokens, use `java.security.SecureRandom` instead.
  languages: [java]
  severity: WARNING
  metadata:
    functional-categories:
      - 'crypto::search::randomness::java.security'
    owasp:
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    cwe:
    - 'CWE-330: Use of Insufficiently Random Values'
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  pattern-either:
  - pattern: |
      new java.util.Random(...).$FUNC(...)
  - pattern: |
      java.lang.Math.random(...)