contrib.nodejsscan.logic_bypass.node_logic_bypass

rules:
  - id: node_logic_bypass
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $REQ.$FOO.$BAR !== $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR === $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR >= $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR <= $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR < $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO.$BAR > $REQ.$ZOO.$ZAR
          - pattern: |
              $REQ.$FOO['...'] !== $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] === $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] >= $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] <= $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] < $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO['...'] > $REQ.$ZOO['...']
          - pattern: |
              $REQ.$FOO('...') !== $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') === $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') >= $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') <= $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') < $REQ.$ZOO('...')
          - pattern: |
              $REQ.$FOO('...') > $REQ.$ZOO('...')
    message: User controlled data is used for application business logic decision
      making. This expose protected data or functionality.
    languages:
      - javascript
    severity: ERROR
    metadata:
      owasp: A05:2017 - Broken Access Control
      cwe: "CWE-807: Reliance on Untrusted Inputs in a Security Decision"
      category: security
      technology:
        - node.js
        - express
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]