[
  {
    "id": "PATH001",
    "pattern": "include\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang)|require(?:_once)?\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Path traversal — broader coverage",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH002",
    "pattern": "path\\.join\\s*\\([^)]*(?:filename|file|name|param|input|req\\.|request\\.|dir\\b|upload)|path\\.resolve\\s*\\([^)]*(?:req\\.|request\\.)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Path traversal — broader coverage",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH003",
    "pattern": "(?:uploadDir|baseDir|BASE_DIR|downloadDir|uploadRoot|templateRoot|configRoot)\\s*\\+\\s*|os\\.Open\\s*\\([^)]*\\+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal: base path + user input concatenation",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH004",
    "pattern": "File\\s*\\([^)]*(?:filename|request\\.|params\\[|getParameter)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Kotlin/Java file path",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "PATH005",
    "pattern": "AdmZip|ZipEntry|zipEntry\\.getName\\s*\\(\\)|entry\\.getName|ZipArchive|archive\\.by_index|archive\\.len\\(\\)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Zip-slip",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH006",
    "pattern": "Path\\.Combine\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|name\\b)",
    "flags": "i",
    "category": "path_traversal",
    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "PATH007",
    "pattern": "File\\.(?:WriteAllText|ReadAllText|Open|ReadAllBytes)\\s*\\([^)]*(?:reportName|filename|Request\\[|\\.Value\\b|path\\b)",
    "flags": "i",
    "category": "path_traversal",
    "description": "C# path traversal (Path.Combine with user input, File.WriteAllText)",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "PATH008",
    "pattern": "Path\\.Combine\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*,\\s*\\w+\\s*\\)",
    "flags": "i",
    "category": "path_traversal",
    "description": "C# path traversal via variable named 'path' that was set with Path.Combine + user input",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "PATH009",
    "pattern": "\\w+(?:Base|Dir|Path|Folder|Root)\\s*\\+\\s*\\w+(?:Name|File|Path|Input)",
    "flags": "i",
    "category": "path_traversal",
    "description": "C# path traversal: base string + user-supplied name string concatenation",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "PATH010",
    "pattern": "File\\.(?:read|write|open|binread)\\s*\\([^)]*#\\{|File\\.(?:read|write|open|binread)\\s*\\(\\s*(?:path|params\\[|request\\.)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Ruby File.read / File.write with string interpolation (user-controlled path)",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "PATH011",
    "pattern": "[\"'\\/][\\/\\w\\-\\.]*\\/[\"']*#\\{[a-zA-Z_]\\w*\\}[\"']?",
    "flags": "",
    "category": "path_traversal",
    "description": "Ruby path string interpolation: \"/base/path/#{user_var}\"",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "PATH012",
    "pattern": "filepath\\.Join\\s*\\([^)]*(?:tmpl|template|name|path|param|input|rel|query)\\b",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go filepath.Join / path.Join without validation",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH013",
    "pattern": "(?:FileInputStream|FileOutputStream|FileReader|FileWriter)\\s*\\([^)]*\\+\\s*\\w|(?:FileInputStream|FileOutputStream)\\s*\\(\\w+\\s*\\+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Java FileInputStream / FileOutputStream with string concat",
    "language": [
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "PATH014",
    "pattern": "format!\\s*\\(\\s*[\"'][^\"']*\\{[^}]*\\}[^\"']*[\"'][^)]*(?:config|plugin|template|user|path|name)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Rust format! macro constructing file paths from user input",
    "language": [
      "rust"
    ],
    "severity": "high"
  },
  {
    "id": "PATH015",
    "pattern": "(?:const\\s+\\w+\\s*=\\s*|let\\s+path\\s*=\\s*)format!\\s*\\(\\s*[\"'][^\"']*\\/\\{\\}[\"']",
    "flags": "",
    "category": "path_traversal",
    "description": "Go/Rust const string + user variable for file path",
    "language": [
      "go",
      "rust"
    ],
    "severity": "high"
  },
  {
    "id": "PATH016",
    "pattern": "[`\"'][.\\/][^`\"']*\\/\\$\\{(?:req\\.|request\\.|params\\.|query\\.|userInput|filename|template|plugin|name)",
    "flags": "i",
    "category": "path_traversal",
    "description": "JS template literal path construction: `./dir/${userVar}` or `/base/${param}`",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH017",
    "pattern": "require(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]|include(?:_once)?\\s*\\(\\s*['\"][^'\"]*['\"]\\s*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP require/include with string concatenation: require('dir/' . $var)",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH018",
    "pattern": "File\\s*\\(\\s*[\"'][^\"']*[\"']\\s*\\+\\s*\\w|File\\s*\\(\\s*\"\\$|File\\s*\\(\\s*[\"'][^\"']*\\/\"\\s*\\+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Kotlin/Java File() with string interpolation or parameter variable",
    "language": [
      "kotlin",
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "PATH019",
    "pattern": "%00|\\\\x00|\\\\u0000",
    "flags": "",
    "category": "path_traversal",
    "description": "Null byte injection pattern",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH020",
    "pattern": "%2e%2e|%252e|%2f%2e",
    "flags": "i",
    "category": "path_traversal",
    "description": "URL-encoded traversal: %2e%2e or %2f",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "PATH021",
    "pattern": "\\binclude\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|page|template|lang|plugin)",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH022",
    "pattern": "\\brequire\\s*\\(\\s*\\$(?:_GET|_POST|_REQUEST|module|lang|view|component)",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH023",
    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|filename|logFile)",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH024",
    "pattern": "readfile\\s*\\(\\s*\\$(?:base|path|file)",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH025",
    "pattern": "\\bfopen\\s*\\(\\s*\\$(?:filepath|path|report)\\s*,",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH026",
    "pattern": "file_get_contents\\s*\\(\\s*['\"][^\\\"']*['\"]\\s*\\.\\s*\\$(?:filename|file|name|logFile|log)",
    "flags": "i",
    "category": "path_traversal",
    "description": "PHP path traversal: file_get_contents with string concat to user var",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "PATH027",
    "pattern": "os\\.Open\\s*\\(\\s*\\w+(?:Dir|Root|Base|Path)\\s*\\+\\s*\\w+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH028",
    "pattern": "ioutil\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH029",
    "pattern": "os\\.ReadFile\\s*\\(\\s*\\w+(?:Root|Base|Dir|Path)\\s*\\+\\s*\\w+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH030",
    "pattern": "os\\.Create\\s*\\(\\s*\\w+(?:Base|Dir|Root|Path)\\s*\\+\\s*\\w+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH031",
    "pattern": "os\\.Remove\\s*\\(\\s*\\w+(?:Root|Base|Dir)\\s*\\+\\s*\\w+",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH032",
    "pattern": "filepath\\.Join\\s*\\([^)]*(?:extractBase|uploadRoot|configRoot|templateRoot|reportBase)\\s*,",
    "flags": "i",
    "category": "path_traversal",
    "description": "Go path traversal",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "PATH033",
    "pattern": "\\.resolve\\s*\\(\\s*\\w*(?:Name|name|file|path|template)\\w*\\s*\\)",
    "flags": "i",
    "category": "path_traversal",
    "description": "Java: path traversal via Path.resolve(userInput)",
    "language": [
      "java"
    ],
    "severity": "high"
  }
]