rules:
- id: new-function-detected
  patterns:
  - pattern-not: |
      $FUNC = new Function('...');
      ...
      $FUNC();
  - pattern: |
      $FUNC = new Function(...);
      ...
      $FUNC();
  message: >-
    Detected the use of new Function(), which can be dangerous if used to evaluate
    dynamic content. If this content can be input from outside the program, this
    may be a code injection vulnerability. Ensure evaluated content is not definable
    by external sources.
  metadata:
    cwe: "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')"
    owasp: 'A1: Injection'
    category: security
    technology:
    - browser
  languages: [javascript, typescript]
  severity: WARNING