rules:
- id: detect-child-process
  metadata:
    cwe: "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
    owasp: 'A1: Injection'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-child-process.js
    category: security
    technology:
    - javascript
  message: >-
    Detected non-literal calls to $EXEC(). This could lead to a command
    injection vulnerability.
  patterns:
  - pattern-either:
    - pattern: exec($CMD,...)
    - pattern: execSync($CMD,...)
    - pattern: spawn($CMD,...)
    - pattern: spawnSync($CMD,...)
  - pattern-not-inside: $EXEC("...",...)
  - pattern-not-inside: $EXEC(["...",...],...)
  - pattern-not-inside: |
      $CMD = "..."
      ...
  - pattern-not-inside: |
      $CMD = ["...",...]
      ...
  severity: WARNING
  languages:
  - javascript
  - typescript