|
129 | 129 | matches(//mule:mule/db:config/db:mssql-connection/@host, |
130 | 130 | '^\$\{.*\}$') |
131 | 131 | </rule> |
| 132 | + <rule id="11" |
| 133 | + name="Domain - HTTP Requestor reconnection strategy should use a configurable count value" |
| 134 | + description="<b>Domain</b> - HTTP Requestor reconnection strategy should use a configurable count value" |
| 135 | + severity="MAJOR" applies="file" type="bug"> |
| 136 | + count(//domain:mule-domain/http:request-config/http:request-connection) |
| 137 | + = count( |
| 138 | + //domain:mule-domain/http:request-config/http:request-connection/mule:reconnection/mule:reconnect[matches(@count,'^\$\{.*\}$')] |
| 139 | + ) |
| 140 | + </rule> |
| 141 | + <rule id="12" |
| 142 | + name="Domain - HTTP Requestor reconnection strategy should use configurable frequency" |
| 143 | + description="<b>Domain</b> - HTTP Requestor reconnection strategy should use configurable frequency" |
| 144 | + severity="MAJOR" applies="file" type="bug"> |
| 145 | + count(//domain:mule-domain/http:request-config/http:request-connection) |
| 146 | + = count( |
| 147 | + //domain:mule-domain/http:request-config/http:request-connection/mule:reconnection/mule:reconnect[matches(@frequency,'^\$\{.*\}$')] |
| 148 | + ) |
| 149 | + </rule> |
| 150 | + <rule id="13" |
| 151 | + name="Domain - Mule Secure Properties should use AES-CBC algorithm" |
| 152 | + description="<b>Domain</b> - Mule Secure Properties should use AES-CBC algorithm" |
| 153 | + severity="MAJOR" applies="file" type="vulnerability"> |
| 154 | + count(//domain:mule-domain/secure-properties:config/secure-properties:encrypt[@algorithm!='AES' |
| 155 | + or @mode!='CBC']) = 0 |
| 156 | + </rule> |
| 157 | + <rule id="14" |
| 158 | + name="Domain - HTTP Listener should not use a hardcoded port value" |
| 159 | + description="<b>Domain</b> - HTTP Listener should not use a hardcoded port value" |
| 160 | + severity="MAJOR" applies="file" type="code_smell"> |
| 161 | + count(//domain:mule-domain/http:listener-config)=0 |
| 162 | + or |
| 163 | + matches(//domain:mule-domain/http:listener-config/http:listener-connection/@port, |
| 164 | + '^\$\{.*\}$') |
| 165 | + </rule> |
| 166 | + <rule id="15" |
| 167 | + name="Domain - HTTP Requestor Configuration should reference a TLS Configuration" |
| 168 | + description="<b>Domain</b> - HTTP Requestor should reference a TLS Configuration" |
| 169 | + severity="MINOR" applies="file" type="bug"> |
| 170 | + count(//domain:mule-domain/http:request-config) = |
| 171 | + count(//domain:mule-domain/http:request-config/http:request-connection[matches(@tlsContext,'^\$\{.*\}$')]) |
| 172 | + </rule> |
| 173 | + <rule id="16" |
| 174 | + name="Domain - Trust Store Configuration should use a configurable path" |
| 175 | + description="<b>Domain</b> - Trust Store Configuration should use a configurable path" |
| 176 | + severity="MINOR" applies="file" type="vulnerability"> |
| 177 | + count(//domain:mule-domain/tls:context/tls:trust-store) = |
| 178 | + count(//domain:mule-domain/tls:context/tls:trust-store[matches(@path,'^\$\{.*\}$')]) |
| 179 | + </rule> |
| 180 | + <rule id="17" |
| 181 | + name="Domain - Key Store Configuration should use a configurable path" |
| 182 | + description="<b>Domain</b> - Key Store Configuration should use a configurable path" |
| 183 | + severity="MINOR" applies="file" type="vulnerability"> |
| 184 | + count(//domain:mule-domain/tls:context/tls:key-store) = |
| 185 | + count(//domain:mule-domain/tls:context/tls:key-store[matches(@path,'^\$\{.*\}$')]) |
| 186 | + </rule> |
| 187 | + <rule id="18" |
| 188 | + name="Domain - Trust Store Configuration should not have the insecure attribute" |
| 189 | + description="<b>Domain</b> - Trust Store Configuration should not have the insecure attribute" |
| 190 | + severity="CRITICAL" applies="file" type="vulnerability"> |
| 191 | + count(//domain:mule-domain/tls:context/tls:trust-store) = |
| 192 | + count(//domain:mule-domain/tls:context/tls:trust-store[not(@insecure)]) |
| 193 | + </rule> |
| 194 | + <rule id="19" |
| 195 | + name="Domain - HTTPS Listener should have a TLS Configuration" |
| 196 | + description="<b>Domain</b> - HTTPS Listener should have a TLS Configuration" |
| 197 | + severity="MAJOR" applies="file" type="vulnerability"> |
| 198 | + count(//domain:mule-domain/http:listener-config/http:listener-connection[@protocol='HTTPS' |
| 199 | + and not(@tlsContext)])=0 |
| 200 | + </rule> |
| 201 | + <rule id="20" |
| 202 | + name="Domain - HTTP Requestor Configuration should not use dynamic default headers or query params" |
| 203 | + description="<b>Domain</b> - HTTP Requestor Configuration should not use dynamic default headers or query params" |
| 204 | + severity="CRITICAL" applies="file" type="code_smell"> |
| 205 | + count(//domain:mule-domain/http:request-config/http:default-headers/http:default-header[matches(@value,'^#\[.*\]$')]) |
| 206 | + = 0 |
| 207 | + and |
| 208 | + count(//domain:mule-domain/http:request-config/http:default-query-params/http:query-param[matches(@value,'^#\[.*\]$')]) |
| 209 | + = 0 |
| 210 | + </rule> |
| 211 | + <rule id="21" |
| 212 | + name="Domain - HTTP Requestor Configuration should have a configurable Response Timeout" |
| 213 | + description="<b>Domain</b> - HTTP Requestor Configuration should have a configurable Response Timeout" |
| 214 | + severity="CRITICAL" applies="file" type="bug"> |
| 215 | + count(//domain:mule-domain/http:request-config[not(@responseTimeout) |
| 216 | + or not(matches(@responseTimeout,'^\$\{.*\}$'))]) = 0 |
| 217 | + </rule> |
132 | 218 | </ruleset> |
133 | 219 | </rulestore> |
134 | 220 |
|
0 commit comments