rules:
- id: insecure-document-method
  patterns:
  - pattern-either:
    - pattern: |
        $EL.innerHTML = $HTML;
    - pattern: |
        $EL.outerHTML = $HTML;
    - pattern: document.write(...)
  - pattern-not: |
      $EL.innerHTML = "...";
  - pattern-not: |
      $EL.outerHTML = "...";
  - pattern-not: document.write("...")
  message: >-
    User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
  metadata:
    cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
    owasp: 'A7: Cross-Site Scripting (XSS)'
    category: security
    technology:
    - browser
  languages:
  - javascript
  - typescript
  severity: WARNING