rules:
- id: autoescape-disabled
  message: >-
    Detected an element with disabled HTML escaping. If external
    data can reach this, this is a cross-site scripting (XSS)
    vulnerability. Ensure no external data can reach here, or
    remove 'escape=false' from this element.
  metadata:
    owasp: 'A07:2017 - Cross-Site Scripting (XSS)'
    cwe:
    - 'CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences'
    references:
    - https://stackoverflow.com/a/7442668
    category: security
    technology:
    - jsf
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  pattern-regex: |-
    .*escape.*?=.*?false.*
  paths:
    include:
    - '*.html'
    - '*.xhtml'
  languages: [regex]
  severity: WARNING