rules:
- id: use-jstl-escaping
  message: >-
    Detected an Expression Language segment in a tag that does not escape
    output. This is dangerous because if any data in this expression
    can be controlled externally, it is a cross-site scripting
    vulnerability. Instead, use the 'out' tag from the JSTL taglib
    to escape this expression.
    See https://www.tutorialspoint.com/jsp/jstl_core_out_tag.htm
    for more information.
  metadata:
    owasp:
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe:
    - 'CWE-116: Improper Encoding or Escaping of Output'
    references:
    - https://www.tutorialspoint.com/jsp/jstl_core_out_tag.htm
    - https://stackoverflow.com/a/4948856
    - https://stackoverflow.com/a/3180202
    category: security
    technology:
    - jsp
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  pattern-regex: <(?![A-Za-z0-9]+:out).*?\$\{.*?\}.*>
  paths:
    include:
    - '*.jsp'
  languages: [regex]
  severity: WARNING