rules:
- id: sax-xxe
  message: >-
    Use of 'ondoctype' in 'sax' library detected. By default, 'sax'
    won't do anything with custom DTD entity definitions. If you're
    implementing a custom DTD entity definition, be sure not to introduce
    XML External Entity (XXE) vulnerabilities, or be absolutely sure that
    external entities received from a trusted source while processing XML.
  metadata:
    owasp: 'A4: XML External Entities (XXE)'
    cwe: 'CWE-611: Improper Restriction of XML External Entity Reference'
    references:
    - https://github.com/Leonidas-from-XIV/node-xml2js/issues/415
    - https://github.com/isaacs/sax-js
    category: security
    technology:
    - sax
  severity: WARNING
  languages: [javascript, typescript]
  pattern-either:
  - pattern: |
      require('sax');
      ...
      $PARSER.ondoctype = ...;
  - pattern: |-
      require('sax');
      ...
      $PARSER.on('doctype',...);