rules:
- id: detect-disable-mustache-escape
  metadata:
    cwe: 'CWE-116: Improper Encoding or Escaping of Output'
    owasp: 'A7: Cross-Site Scripting (XSS)'
    source-rule-url: https://github.com/nodesecurity/eslint-plugin-security/blob/master/rules/detect-disable-mustache-escape.js
    category: security
    technology:
    - mustache
  message: >-
    Markup escaping disabled. This can be used with some template engines to escape
    disabling of HTML entities, which can lead to XSS attacks.
  pattern: $OBJ.escapeMarkup = false
  severity: WARNING
  languages:
  - javascript
  - typescript