rules:
- id: react-jwt-decoded-property
  message: >-
    Property decoded from JWT token without verifying and cannot be trustworthy.
  metadata:
    cwe:
    - 'CWE-922: Insecure Storage of Sensitive Information'
    references:
    - https://pragmaticwebsecurity.com/articles/oauthoidc/localstorage-xss.html
    category: security
    owasp:
    - A01:2021 - Broken Access Control
    - A01:2025 - Broken Access Control
    technology:
    - react
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
    confidence: LOW
  languages:
  - typescript
  - javascript
  severity: INFO
  patterns:
  - pattern-inside: |
      import jwt_decode from "jwt-decode";
      ...
  - pattern-inside: |
      $DECODED = jwt_decode($TOKEN,...);
      ...
  - pattern: $DECODED.$PROPERTY