ajinabraham.njsscan.database.sequelize_weak_tls.sequelize_weak_tls

rules:
  - id: sequelize_weak_tls
    message: >
      The Sequelize connection string indicates that an older version of TLS is
      in use. TLS1.0 and TLS1.1 are deprecated and should be used. By default,
      Sequelize use TLSv1.2 but it's recommended to use TLS1.3. Not applicable
      to SQLite database.
    metadata:
      owasp-web: a6
      cwe: cwe-757
      license: LGPL-3.0-or-later
      vulnerability_class:
        - Other
    severity: ERROR
    languages:
      - javascript
    patterns:
      - pattern-inside: |
          {
            host: $HOST,
            database: $DATABASE,
            dialect: $DIALECT,
            dialectOptions:
              { ssl: ... }
           }
      - pattern-either:
          - pattern: |
              {
                minVersion: 'TLSv1'
              }
          - pattern: |
              {
                minVersion: 'TLSv1.1'
              }
      - metavariable-regex:
          metavariable: $DIALECT
          regex: "['\"](mariadb|mysql|postgres)['\"]"