rules:
- id: detect-angular-sce-disabled
  message: >-
    $sceProvider is set to false. Disabling Strict Contextual escaping (SCE) in an AngularJS application
    could provide additional attack surface for XSS vulnerabilities.
  metadata:
    cwe:
    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    references:
    - https://docs.angularjs.org/api/ng/service/$sce
    - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
    category: security
    technology:
    - angular
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: HIGH
    impact: MEDIUM
    confidence: HIGH
  languages:
  - javascript
  - typescript
  severity: ERROR
  pattern: |
    $sceProvider.enabled(false);