find-sink.yaml

rules:
- id: find-sink-python
  pattern: |
    def $HANDLER(event, context):
      ...
      $SINK(...,<... event ...>,...)
  message: $SINK
  languages:
  - python
  severity: ERROR
- id: find-sink-js-1
  patterns:
  - pattern-either:
    - pattern-inside: |
        exports.$HANDLER = function ($EVENT) {
        ...
        }
    - pattern-inside: |
        exports.$HANDLER = function ($EVENT, $CTX) {
        ...
        }
    - pattern-inside: |
        exports.$HANDLER = function ($EVENT, $CTX, $CLB) {
        ...
        }
    - pattern-inside: |
        module.exports.$HANDLER = function ($EVENT) {
        ...
        }
    - pattern-inside: |
        module.exports.$HANDLER = function ($EVENT, $CTX) {
        ...
        }
    - pattern-inside: |
        module.exports.$HANDLER = function ($EVENT, $CTX, $CLB) {
        ...
        }
    - pattern-inside: |
        export function $HANDLER($EVENT) {
          ...
        }
    - pattern-inside: |
        export function $HANDLER($EVENT, $CTX) {
          ...
        }
    - pattern-inside: |
        export function $HANDLER($EVENT, $CTX, $CLB) {
        ...
        }
  - pattern-either:
    - pattern: $SINK(...,<... $EVENT ...>,...)
    - pattern: $SINK(...,<... $EVENT.$ONE ...>,...)
    - pattern: $SINK(...,<... $EVENT.$ONE.$TWO ...>,...)
    - pattern: $SINK(...,<... $EVENT.$ONE.$TWO.$THREE ...>,...)
  message: $SINK ($EVENT.$ONE.$TWO.$THREE)
  languages:
  - javascript
  - typescript
  severity: ERROR
- id: find-sink-js-2
  pattern-either:
  - pattern: |
      exports.$HANDLER = function ($E) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      exports.$HANDLER = function ($E) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      exports.$HANDLER = function ($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      exports.$HANDLER = function ($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      exports.$HANDLER = function ($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      exports.$HANDLER = function ($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      module.exports.$HANDLER = function ($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E, $CTX) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $SINK(...,<... $R ...>,...);
        ...
      }
  - pattern: |
      export function $HANDLER($E, $CTX, $CB) {
        ...
        $R = <... $E ...>;
        ...
        $K = <... $R ...>;
        ...
        $SINK(...,<... $K ...>,...);
        ...
      }
  message: $SINK ($E)
  languages:
  - javascript
  - typescript
  severity: ERROR