rules:
- id: math-random-used
  metadata:
    cwe: 'CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)'
    owasp: 'A3: Sensitive Data Exposure'
    references:
    - https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html#secure-random-number-generation
    category: security
    technology:
    - go
  message: Do not use `math/rand`. Use `crypto/rand` instead.
  languages: [go]
  severity: WARNING
  pattern-either:
  - patterns:
    - pattern-inside: |
        import mrand "math/rand"
        ...
    - pattern-either:
      - pattern: mrand.Int()
      - pattern: mrand.Read(...)
  - patterns:
    - pattern-inside: |
        import "math/rand"
        ...
    - pattern-not-inside: |
        import "crypto/rand"
        ...
    - pattern-either:
      - pattern: rand.Int()
      - pattern: rand.Read(...)