rules:
- id: remote-property-injection
  message: >-
    Bracket object notation with user input is present, this might allow an attacker to access all properties of the object
    and even it's prototype. Use literal values for object properties.
  metadata:
    owasp: 'A1: Injection'
    cwe: "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
    category: security
    technology:
    - express
  severity: ERROR
  languages: [javascript, typescript]
  patterns:
  - pattern-either:
    - pattern: $OBJ[$REQ.$QUERY.$FOO] = ...
    - pattern: $OBJ[$REQ.$BODY] = ...
    - patterns:
      - pattern: $OBJ[$PARAM] = ...
      - pattern-either:
        - pattern-inside: |
            $PARAM = $REQ.$QUERY.$FOO
            ...
        - pattern-inside: |
            $PARAM = $REQ.$BODY
            ...
  - pattern-either:
    - pattern-inside: function ... ($REQ, $RES) {...}
    - pattern-inside: function ... ($REQ, $RES, $NEXT) {...}
    - pattern-inside: $APP.get(..., function $FUNC($REQ, $RES) {...})
    - pattern-inside: $APP.post(..., function $FUNC($REQ, $RES) {...})
    - pattern-inside: $APP.put(..., function $FUNC($REQ, $RES) {...})
    - pattern-inside: $APP.head(..., function $FUNC($REQ, $RES) {...})
    - pattern-inside: $APP.delete(..., function $FUNC($REQ, $RES) {...})
    - pattern-inside: $APP.options(..., function $FUNC($REQ, $RES) {...})