rules:
- id: insecure-object-assign
  mode: taint
  message: >-
    Depending on the context, user control data in `Object.assign` can cause web response
    to include data that it should not have or can lead to a mass assignment vulnerability.
  metadata:
    cwe: "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"
    owasp: 'A1: Injection'
    references:
    - https://nodesecroadmap.fyi/chapter-1/threat-EXF.html
    - https://en.wikipedia.org/wiki/Mass_assignment_vulnerability
    category: security
    technology:
    - javascript
  languages:
  - javascript
  - typescript
  severity: WARNING
  pattern-sources:
  - patterns:
    - pattern: JSON.parse(...)
    - pattern-not: JSON.parse("...",...)
  pattern-sinks:
  - pattern: Object.assign(...)