rules:
- id: detect-bracket-object-injection
  patterns:
  - pattern: |
      $VAR = $OBJ[$FIELD];
  - pattern-not: |
      $VAR = $OBJ[($FIELD : float)];
  - pattern-not: |
      $VAR = $OBJ["..."];
  - pattern-not-inside: |
      $FIELD = ...;
      ...
  message: >-
    Object injection via bracket notation via $FIELD
  severity: WARNING
  languages:
  - javascript
  - typescript
  metadata:
    category: security
    technology:
    - javascript