rules:
- id: ssl-mode-no-verify
  pattern: OpenSSL::SSL::VERIFY_NONE
  message: >-
    Detected SSL that will accept an unverified connection.
    This makes the connections susceptible to man-in-the-middle attacks.
    Use 'OpenSSL::SSL::VERIFY_PEER' instead.
  fix-regex:
    regex: VERIFY_NONE
    replacement: VERIFY_PEER
  severity: WARNING
  languages:
  - ruby
  metadata:
    cwe:
    - 'CWE-295: Improper Certificate Validation'
    category: security
    technology:
    - ruby
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A07:2021 - Identification and Authentication Failures
    - A07:2025 - Authentication Failures
    references:
    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: MEDIUM