rules:
  - id: express-sandbox-code-injection
    message: >-
      Make sure that unverified user data can not reach `sandbox`.
    severity: ERROR
    languages: [javascript]
    metadata:
      owasp: "A01:2017 - Injection"
      cwe: "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    patterns:
      - pattern-either:
          - pattern-inside: |
              # ruleid: slow-pattern-general-func
              function ($REQ, $RES, ...) {
                  ...
              }
          # ruleid: slow-pattern-general-func
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          # ruleid: slow-pattern-general-func
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
      - pattern-either:
          - pattern: |
              $S = new $SANDBOX(...);
              ...
              $S.run(<... $REQ.$QUERY.$FOO ...>,...);