rules:
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    metadata:
      owasp: 
        - "A03:2021 - Injection"
      # ruleid: metadata-deepsemgrep
      deepsemgrep: true
      cwe: 
        - "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      likelihood: HIGH
      impact: HIGH
      confidence: HIGH
      subcategory: 
        - vuln
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns: 
  - id: require-request
    message: >-
      If an attacker controls the x in require(x) then they can cause code to load that was not intended to run on the server.
    severity: LOW
    languages: [javascript, typescript]
    metadata:
      owasp: 
        - "A03:2021 - Injection"
      # ruleid: metadata-deepsemgrep
      deepsemgrep: true
      cwe: 
        - "CWE-706: Use of Incorrectly-Resolved Name or Reference"
      source-rule-url: https://nodesecroadmap.fyi/chapter-1/threat-UIR.html
      category: security
      likelihood: HIGH
      impact: HIGH
      confidence: HIGH
      subcategory: 
        - vuln
      technology:
        - express
      references:
        - https://github.com/google/node-sec-roadmap/blob/master/chapter-2/dynamism.md#dynamism-when-you-need-it
    patterns: