contrib.nodejsscan.resolve_path_traversal.join_resolve_path_traversal

rules:
  - id: join_resolve_path_traversal
    patterns:
      - pattern-inside: |
          require('path');
          ...
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: $PATH.join(...,<... $REQ.$BODY ...>,...)
          - pattern: $PATH.join(...,<... $REQ.$QUERY.$FOO ...>,...)
          - pattern: |
              $VAR = <... $REQ.$BODY ...>;
              ...
              $PATH.join(...,<... $VAR ...>,...);
          - pattern: |
              $VAR = <... $REQ.$QUERY.$FOO ...>;
              ...
              $PATH.join(...,<... $VAR ...>,...);
          - pattern: $PATH.resolve(...,<... $REQ.$BODY ...>,...)
          - pattern: $PATH.resolve(...,<... $REQ.$QUERY.$FOO ...>,...)
          - pattern: |
              $VAR = <... $REQ.$BODY ...>;
              ...
              $PATH.resolve(...,<... $VAR ...>,...);
          - pattern: |-
              $VAR = <... $REQ.$QUERY.$FOO ...>;
              ...
              $PATH.resolve(...,<... $VAR ...>,...);
    message: Path constructed with user input can result in Path Traversal. Ensure
      that user input does not reach `join()` or `resolve()`.
    languages:
      - javascript
    metadata:
      owasp: A05:2017 - Broken Access Control
      cwe: "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path
        Traversal')"
      category: security
      technology:
        - node.js
        - express
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    severity: WARNING