[
  {
    "id": "XXE001",
    "pattern": "XMLReaderFactory|DocumentBuilderFactory|XmlReader.*DtdProcessing",
    "flags": "",
    "category": "xxe",
    "description": "XXE",
    "language": [
      "js",
      "ts",
      "python",
      "java",
      "go",
      "csharp",
      "php",
      "ruby",
      "rust",
      "kotlin"
    ],
    "severity": "critical"
  },
  {
    "id": "XXE002",
    "pattern": "DtdProcessing\\s*=\\s*DtdProcessing\\.Parse",
    "flags": "i",
    "category": "xxe",
    "description": "C# XXE: XmlDocument/XmlReader",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "XXE003",
    "pattern": "XmlResolver\\s*=\\s*new XmlUrlResolver\\s*\\(\\)",
    "flags": "i",
    "category": "xxe",
    "description": "C# XXE: XmlDocument/XmlReader",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "XXE004",
    "pattern": "new XPathDocument\\s*\\(",
    "flags": "i",
    "category": "xxe",
    "description": "C# XXE: XPathDocument (no resolver set = default unsafe on older .NET)",
    "language": [
      "csharp"
    ],
    "severity": "critical"
  },
  {
    "id": "XXE005",
    "pattern": "SAXParserFactory\\.newInstance\\s*\\(\\s*\\)",
    "flags": "",
    "category": "xxe",
    "description": "Java: XXE via SAXParserFactory without secure processing",
    "language": [
      "java"
    ],
    "severity": "critical"
  }
]