Open_Ultra_SAST/src/openultrasast/ruleset/semantic/javascript.toml

version = "1"
language = "javascript"

[[source]]
id = "req"
patterns = ["req.query", "req.body", "req.params", "req.cookies", "req.headers", "request.query"]

[[sink]]
id = "eval"
cwe = "CWE-95"
calls = ["eval"]
rule_ids = ["js-eval"]

[[sink]]
id = "exec"
cwe = "CWE-78"
calls = ["exec", "execSync"]
rule_ids = ["js-command-exec"]

[[sink]]
id = "query"
cwe = "CWE-89"
calls = ["query", "execute"]
rule_ids = ["js-sql-injection"]

[[sanitizer]]
id = "parameterized_query"
calls = ["query", "execute"]
parameterized = true

# --- model-grounded-detection: raw-Node request sources -------------------------------------------------
# The shipped `req` source fact carries the Express idioms (req.query, req.body, req.params). A raw Node
# http server -- which is what a static file server is -- reads the path straight off `req.url`
# (http.IncomingMessage.url), and `url.parse(req.url)` is the documented way to split it. Measured need:
# with these absent, the angular-http-server path-traversal pair resolved its flow to the captured `res`
# rather than to attacker input, because no modelled source matched.

[[source]]
id = "node-request"
patterns = ["req.url", "request.url", "req.rawHeaders", "url.parse", "parsedUrl"]

# --- model-grounded-detection task 4.2 -------------------------------------------------------------------
# See the note in python.toml: documented dangerous APIs, provenance per entry, reviewed as data.

[[sink]]
# CWE-1321. Prototype pollution reaches the object graph through a recursive merge or an unchecked
# dynamic key. These are the documented merge helpers plus the assignment forms.
id = "prototype.merge"
cwe = "CWE-1321"
calls = ["merge", "mergeDeep", "extend", "defaultsDeep", "Object.assign", "set", "setWith"]
rule_ids = []

[[sink]]
# CWE-79. The documented "trusted HTML" sinks in the DOM and the major frameworks.
id = "html.unescaped"
cwe = "CWE-79"
calls = ["innerHTML", "outerHTML", "insertAdjacentHTML", "document.write", "dangerouslySetInnerHTML", "v-html"]
rule_ids = []

[[sink]]
# CWE-22. Node filesystem entry points that accept a caller-supplied path.
id = "path.open"
cwe = "CWE-22"
calls = ["readFile", "readFileSync", "createReadStream", "sendFile", "unlink", "unlinkSync"]
rule_ids = []

[[sink]]
# CWE-918 / CWE-601: outbound requests and redirects to a caller-supplied destination.
id = "outbound.request"
cwe = "CWE-918"
calls = ["axios.get", "axios.post", "fetch", "request", "got", "http.get", "https.get"]
rule_ids = []

[[sink]]
id = "redirect"
cwe = "CWE-601"
calls = ["redirect", "location.assign", "location.replace"]
rule_ids = []

# --- model-grounded-detection: sanitizers -----------------------------------------------------------------
# This file shipped with no [[sanitizer]] entries at all, so no JavaScript fix of any family could be
# recognised and the model entailed a fixed twin exactly as readily as its vulnerable one. Measured on the
# angular-http-server path-traversal pair, whose fix is precisely `path.normalize(...).replace(/^(\.\.[\/\\])+/, '')`.
# Documented normalising / escaping APIs, provenance per entry, reviewed as data.

[[sanitizer]]
# CWE-22. Node's documented path normalisation; `resolve` and `join` against a fixed base collapse `..`.
id = "path.normalize"
calls = ["path.normalize", "path.resolve"]

[[sanitizer]]
# CWE-79. The standard encoders: the DOM/global URI encoders and the common escaping helpers.
id = "html.escape"
calls = ["encodeURIComponent", "encodeURI", "escapeHtml", "escape", "sanitizeHtml", "DOMPurify.sanitize"]


[[layout]]
# First-party test conventions are retained as graph context, ordered as unshipped.
# These declarations cover JS module/JSX and TS/TSX filenames; they do not assert
# TypeScript property support or a browser/server runtime classification.
id = "javascript_first_party_tests"
vendored = ["node_modules/"]
tests = [
  "tests/", "test/", "spec/", "__tests__/", "__mocks__/", "e2e/",
  "*.test.js", "*.test.mjs", "*.test.cjs", "*.test.jsx", "*.test.ts", "*.test.mts", "*.test.cts", "*.test.tsx",
  "*.spec.js", "*.spec.mjs", "*.spec.cjs", "*.spec.jsx", "*.spec.ts", "*.spec.mts", "*.spec.cts", "*.spec.tsx",
  "*.mock.js", "*.mock.mjs", "*.mock.cjs", "*.mock.jsx", "*.mock.ts", "*.mock.mts", "*.mock.cts", "*.mock.tsx",
  "*.e2e.js", "*.e2e.mjs", "*.e2e.cjs", "*.e2e.jsx", "*.e2e.ts", "*.e2e.mts", "*.e2e.cts", "*.e2e.tsx",
]