rules:
- id: insecure-smtp-connection
  metadata:
    cwe:
    - 'CWE-297: Improper Validation of Certificate with Host Mismatch'
    owasp:
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    source-rule-url: https://find-sec-bugs.github.io/bugs.htm#INSECURE_SMTP_SSL
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  message: >-
    Insecure SMTP connection detected. This connection will trust any SSL certificate.
    Enable certificate verification by setting 'email.setSSLCheckServerIdentity(true)'.
  severity: WARNING
  patterns:
  - pattern-not-inside: |
      $EMAIL.setSSLCheckServerIdentity(true);
      ...
  - pattern-inside: |
      $EMAIL = new SimpleEmail(...);
      ...
  - pattern: |-
      $EMAIL.send(...);
  languages:
  - java