ajinabraham.njsscan.eval.eval_require.eval_require

rules:
  - id: eval_require
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $INP = <... $REQ.$QUERY ...>;
              ...
              require(<... $INP ...>)
          - pattern: |
              $INP = <... $REQ.$QUERY.$FOO ...>;
              ...
              require(<... $INP ...>)
          - pattern: require(<... $REQ.$QUERY.$FOO ...>)
          - pattern: require(<... $REQ.$BODY ...>)
    message: Untrusted user input in `require()` function allows an attacker to load
      arbitrary code.
    severity: ERROR
    languages:
      - javascript
    metadata:
      owasp-web: a1
      cwe: cwe-706
      license: LGPL-3.0-or-later
      vulnerability_class:
        - Other