rules:
- id: weak-crypto
  patterns:
  - pattern-either:
    - pattern: crypt(...)
    - pattern: hash('md5', ...)
    - pattern: hash('sha1', ...)
    - pattern: md5_file(...)
    - pattern: md5(...)
    - pattern: sha1_file(...)
    - pattern: sha1(...)
    - pattern: str_rot13(...)
  message: >-
    Detected usage of weak crypto function. Consider using stronger alternatives.
  metadata:
    cwe:
    - 'CWE-328: Use of Weak Hash'
    references:
    - https://www.php.net/manual/en/book.sodium.php
    - https://github.com/FloeDesignTechnologies/phpcs-security-audit/blob/master/Security/Sniffs/BadFunctions/CryptoFunctionsSniff.php
    category: security
    technology:
    - php
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages: [php]
  severity: ERROR