rules:
- id: detect-angular-translateprovider-translations-method
  message: >-
    The use of $translateProvider.translations method can be dangerous if user input is provided to this
    API.
  metadata:
    cwe:
    - "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    references:
    - https://docs.angularjs.org/api/ng/service/$sce#trustAsUrl
    - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
    category: security
    technology:
    - angular
    - typescript
    owasp:
    - A07:2017 - Cross-Site Scripting (XSS)
    - A03:2021 - Injection
    - A05:2025 - Injection
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
    confidence: LOW
  languages:
  - javascript
  severity: WARNING
  patterns:
  - pattern: |
      $translateProvider.translations(...,$SOURCE);
  - pattern-inside: |
      app.controller(..., function($scope,$sce){
      ...
      });