ajinabraham.njsscan.generic.logic_bypass.node_logic_bypass

rules:
  - id: node_logic_bypass
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $REQ.$FOO.$BAR !== $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR === $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR >= $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR <= $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR < $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR > $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO['...'] !== $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] === $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] >= $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] <= $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] < $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] > $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO('...') !== $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') === $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') >= $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') <= $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') < $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') > $REQ.$ZOO('...')
    message: User controlled data is used for application business logic decision
      making. This expose protected data or functionality.
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp-web: a5
      cwe: cwe-807
      license: LGPL-3.0-or-later
      vulnerability_class:
        - Other