rules:
- id: ftp-use
  patterns:
  - pattern: $FUNC(...);
  - metavariable-regex:
      metavariable: $FUNC
      regex: ftp_.+
  message: >-
    FTP allows for unencrypted file transfers. Consider using an encrypted alternative.
  metadata:
    cwe:
    - 'CWE-319: Cleartext Transmission of Sensitive Information'
    references:
    - https://www.php.net/manual/en/intro.ftp.php
    - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/FringeFunctionsSniff.php
    category: security
    technology:
    - php
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [php]
  severity: ERROR