[
  {
    "id": "XSS001",
    "pattern": "from\\s+mako\\s*\\.\\s*template\\s+import\\s+Template",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: Mako Template().render() — multiline template then render (separate lines)",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS002",
    "pattern": "innerHTML\\s*=|document\\.write\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS (original)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS003",
    "pattern": "render_template_string\\s*\\(|webView.*javaScriptEnabled\\s*=\\s*true",
    "flags": "i",
    "category": "xss",
    "description": "XSS (original)",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS004",
    "pattern": "dangerouslySetInnerHTML\\s*=\\s*\\{\\{?\\s*__html\\s*:",
    "flags": "",
    "category": "xss",
    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS005",
    "pattern": "\\[innerHTML\\]\\s*=",
    "flags": "",
    "category": "xss",
    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS006",
    "pattern": "v-html\\s*=",
    "flags": "",
    "category": "xss",
    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS007",
    "pattern": "\\$\\s*\\([^)]+\\)\\s*\\.\\s*html\\s*\\(\\s*\\w",
    "flags": "",
    "category": "xss",
    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS008",
    "pattern": "\\.outerHTML\\s*=",
    "flags": "",
    "category": "xss",
    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS009",
    "pattern": "\\{\\{\\{[^}]+\\}\\}\\}",
    "flags": "",
    "category": "xss",
    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS010",
    "pattern": "marked\\s*\\(\\s*\\w",
    "flags": "",
    "category": "xss",
    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS011",
    "pattern": "res\\s*\\.\\s*(?:send|end|write)\\s*\\(\\s*`[^`]*\\$\\{",
    "flags": "",
    "category": "xss",
    "description": "XSS — Express res.send/res.end/res.write with template literal containing user input",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS012",
    "pattern": "make_response\\s*\\(\\s*f['\"]|HttpResponse\\s*\\(\\s*f['\"]",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS013",
    "pattern": "HTMLResponse\\s*\\(\\s*content\\s*=\\s*f['\"]",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS014",
    "pattern": "Template\\s*\\([^)]*\\)\\s*\\.render\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS015",
    "pattern": "\\|\\s*safe\\b",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS016",
    "pattern": "ERB\\s*\\.\\s*new\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — Ruby: ERB.new with user-controlled template",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "XSS017",
    "pattern": "<\\?=\\s*\\$[a-zA-Z_]",
    "flags": "",
    "category": "xss",
    "description": "XSS — PHP: short echo tags",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS018",
    "pattern": "io\\s*\\.\\s*WriteString\\s*\\(\\s*w\\b",
    "flags": "",
    "category": "xss",
    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS019",
    "pattern": "template\\s*\\.\\s*HTML\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS020",
    "pattern": "Response\\s*\\.\\s*Write\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS021",
    "pattern": "new\\s+HtmlString\\s*\\(|Html\\s*\\.\\s*Raw\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS022",
    "pattern": "return\\s+Content\\s*\\([^,]+,\\s*[\"']text\\/html[\"']",
    "flags": "",
    "category": "xss",
    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS023",
    "pattern": "webView\\s*\\.\\s*loadData\\s*\\(|webView\\s*\\.\\s*loadDataWithBaseURL\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
    "language": [
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS024",
    "pattern": "allowUniversalAccessFromFileURLs\\s*=\\s*true",
    "flags": "",
    "category": "xss",
    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
    "language": [
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS025",
    "pattern": "call\\s*\\.\\s*respondText\\s*\\([^)]*text\\/html",
    "flags": "",
    "category": "xss",
    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
    "language": [
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS026",
    "pattern": "req\\s*\\.\\s*getHeader\\s*\\(|out\\s*\\.\\s*println\\s*\\([^)]*getParameter",
    "flags": "",
    "category": "xss",
    "description": "XSS — Java: req.getHeader reflection, PrintWriter with getParameter or string concat",
    "language": [
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "XSS027",
    "pattern": "out\\s*\\.\\s*(?:print|println)\\s*\\([^)]*[\"'<][^)]*\\+\\s*\\w|pw\\s*\\.\\s*write\\s*\\([^)]*\\+",
    "flags": "",
    "category": "xss",
    "description": "XSS — Java: out.print/println/pw.write with string concatenation (variable + HTML)",
    "language": [
      "java"
    ],
    "severity": "high"
  },
  {
    "id": "XSS028",
    "pattern": "fmt\\s*\\.\\s*Fprintf\\s*\\(\\s*w\\s*,",
    "flags": "",
    "category": "xss",
    "description": "XSS — Go: fmt.Fprintf(w, \"...%s...\", userVar) — format string with w as target",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS029",
    "pattern": "fmt\\s*\\.\\s*Fprint\\s*\\(\\s*w\\s*,",
    "flags": "",
    "category": "xss",
    "description": "XSS — Go: fmt.Fprint(w, ...) with user data",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS030",
    "pattern": "return\\s+make_response\\s*\\(html\\b|return\\s+HTMLResponse\\s*\\(content\\s*=\\s*html\\b",
    "flags": "",
    "category": "xss",
    "description": "XSS — Python: make_response/HTMLResponse with variable html built from f-string (multiline pattern)",
    "language": [
      "python"
    ],
    "severity": "high"
  },
  {
    "id": "XSS031",
    "pattern": "\"[^\"]*#\\{[^}]+\\}[^\"]*\"|'[^']*#\\{[^}]+\\}[^']*'",
    "flags": "",
    "category": "xss",
    "description": "XSS — Ruby: Sinatra route returning string with interpolation #{...}",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "XSS032",
    "pattern": "call\\s*\\.\\s*respondText\\s*\\(\\s*\\w",
    "flags": "",
    "category": "xss",
    "description": "XSS — Kotlin: call.respondText with HTML variable (not just ContentType inline)",
    "language": [
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS033",
    "pattern": "ErrorMessage\\s*=\\s*\\$['\"]",
    "flags": "",
    "category": "xss",
    "description": "XSS — C#: @Html.Raw rendered from model property (ErrorMessage / body variable)",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS034",
    "pattern": "echo\\s+.*\\$(?:_POST|_GET|_REQUEST|_COOKIE|comment|username|data|error)",
    "flags": "i",
    "category": "xss",
    "description": "XSS - PHP echo with $_POST/$_GET",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS035",
    "pattern": "(?:print_r|var_dump)\\s*\\(\\s*\\$_(?:REQUEST|GET|POST)",
    "flags": "i",
    "category": "xss",
    "description": "XSS - PHP print_r/var_dump user input",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS036",
    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "xss",
    "description": "XSS - concatenation into HTML echo",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS037",
    "pattern": "(?:w\\.Write|fmt\\.Fprintf\\s*\\(\\s*w)[^;]*(?:r\\.URL\\.Query\\(\\)|r\\.FormValue|r\\.Header)",
    "flags": "i",
    "category": "xss",
    "description": "XSS - Go w.Write/fmt.Fprintf with user input",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS038",
    "pattern": "evaluateJavascript\\s*\\(|webView\\.loadUrl\\s*\\(|addJavascriptInterface\\s*\\(",
    "flags": "i",
    "category": "xss",
    "description": "XSS - Kotlin WebView evaluateJavascript",
    "language": [
      "kotlin"
    ],
    "severity": "high"
  },
  {
    "id": "XSS039",
    "pattern": "\\.html_safe\\b|raw\\s*\\(",
    "flags": "",
    "category": "xss",
    "description": "XSS - Ruby on Rails raw/html_safe with user content",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "XSS040",
    "pattern": "Response\\.Write\\s*\\([^)]*(?:Request\\.|QueryString|Form\\[)",
    "flags": "i",
    "category": "xss",
    "description": "C# XSS: Response.Write with user input",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS041",
    "pattern": "context\\.Response\\.Write\\s*\\([^)]*(?:\\+\\s*\\w|\\bname\\b|\\bq\\b)",
    "flags": "i",
    "category": "xss",
    "description": "C# XSS: Response.Write with user input",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS042",
    "pattern": "Response\\.Write\\s*\\(\"[^\"]*\"\\s*\\+",
    "flags": "i",
    "category": "xss",
    "description": "C# XSS: Response.Write with user input",
    "language": [
      "csharp"
    ],
    "severity": "high"
  },
  {
    "id": "XSS043",
    "pattern": "render\\s+html:\\s*\\w+\\.html_safe",
    "flags": "i",
    "category": "xss",
    "description": "Ruby XSS: html_safe / raw()",
    "language": [
      "ruby"
    ],
    "severity": "high"
  },
  {
    "id": "XSS044",
    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|name|query|msg|error|comment)",
    "flags": "i",
    "category": "xss",
    "description": "PHP XSS: echo without htmlspecialchars",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS045",
    "pattern": "<\\?=\\s*\\$(?:username|profile|bio|color|font|theme|src|href)",
    "flags": "i",
    "category": "xss",
    "description": "PHP XSS: echo without htmlspecialchars",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS046",
    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.URL\\.Query\\(\\)\\.Get\\b",
    "flags": "i",
    "category": "xss",
    "description": "Go XSS",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS047",
    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.FormValue\\b",
    "flags": "i",
    "category": "xss",
    "description": "Go XSS",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS048",
    "pattern": "template\\.HTML\\s*\\([^)]*\\+\\s*\\w",
    "flags": "i",
    "category": "xss",
    "description": "Go XSS",
    "language": [
      "go"
    ],
    "severity": "high"
  },
  {
    "id": "XSS049",
    "pattern": "res\\s*\\.\\s*send\\s*\\(\\s*['\"`].*\\+",
    "flags": "",
    "category": "xss",
    "description": "XSS — Express res.send() with string concatenation containing user input",
    "language": [
      "js",
      "ts"
    ],
    "severity": "high"
  },
  {
    "id": "XSS050",
    "pattern": "print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE|_SERVER)\\[",
    "flags": "i",
    "category": "xss",
    "description": "XSS — PHP: print with raw superglobal (unescaped user input)",
    "language": [
      "php"
    ],
    "severity": "high"
  },
  {
    "id": "XSS051",
    "pattern": "echo\\s+[\"'][^\"']*(?:href|src|action|value|data)=[\"']?[^\"'>]*[\"']?\\s*\\.\\s*\\$[a-zA-Z_]",
    "flags": "i",
    "category": "xss",
    "description": "XSS — PHP: echo with user variable injected into HTML attribute (href/src/action)",
    "language": [
      "php"
    ],
    "severity": "high"
  }
]