rules:
  - id: react-dangerously-set-inner-html
    languages: [typescript, javascript]
    severity: ERROR
    message: dangerouslySetInnerHTML ist ein XSS-Einfallstor. Text rendern oder mit DOMPurify säubern.
    pattern-either:
      - pattern: <$EL dangerouslySetInnerHTML={...} />
      - pattern: <$EL dangerouslySetInnerHTML={...}>...</$EL>
      - pattern: "{dangerouslySetInnerHTML: ...}"

  - id: dom-inner-html
    languages: [typescript, javascript]
    severity: ERROR
    message: innerHTML/outerHTML/insertAdjacentHTML mit dynamischem Inhalt (XSS). textContent verwenden.
    patterns:
      - pattern-either:
          - pattern: $EL.innerHTML = $V
          - pattern: $EL.outerHTML = $V
          - pattern: $EL.insertAdjacentHTML($POS, $V)
          - pattern: document.write($V)
      - pattern-not: $EL.innerHTML = "..."
      - pattern-not: $EL.innerHTML = ``

  - id: token-in-web-storage
    languages: [typescript, javascript]
    severity: WARNING
    message: Token/Secret im Web Storage ist per XSS auslesbar. HttpOnly-Cookie verwenden.
    patterns:
      - pattern-either:
          - pattern: localStorage.setItem($K, ...)
          - pattern: sessionStorage.setItem($K, ...)
          - pattern: window.localStorage.setItem($K, ...)
      - metavariable-regex:
          metavariable: $K
          regex: (?i).*(token|jwt|secret|auth|session|password|api.?key).*

  - id: express-cors-wildcard
    languages: [typescript, javascript]
    severity: ERROR
    message: CORS erlaubt jede Origin (bei credentials besonders gefährlich). Origins explizit auflisten.
    pattern-either:
      - pattern: cors()
      - pattern: 'cors({..., origin: "*", ...})'
      - pattern: 'cors({..., origin: true, ...})'
      - pattern: $RES.setHeader("Access-Control-Allow-Origin", "*")
      - pattern: $RES.header("Access-Control-Allow-Origin", "*")

  - id: sql-template-string
    languages: [typescript, javascript]
    severity: ERROR
    message: SQL per Template-String oder Verkettung. Platzhalter/Query-Builder verwenden.
    patterns:
      - pattern-either:
          - pattern: $DB.$M(`...${$X}...`, ...)
          - pattern: $DB.$M("..." + $X, ...)
          - pattern: sql.raw(`...${$X}...`)
          - pattern: sql.raw("..." + $X)
      - metavariable-regex:
          metavariable: $M
          regex: ^(query|exec|execute|prepare|run|all|get|raw|\$queryRawUnsafe|\$executeRawUnsafe)$

  - id: tls-verification-disabled-node
    languages: [typescript, javascript]
    severity: ERROR
    message: TLS-Zertifikatsprüfung abgeschaltet.
    pattern-either:
      - pattern: "{..., rejectUnauthorized: false, ...}"
      - pattern: process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0"

  - id: jwt-decode-without-verify
    languages: [typescript, javascript]
    severity: ERROR
    message: jwt.decode prüft keine Signatur. jwt.verify verwenden.
    pattern-either:
      - pattern: jwt.decode(...)
      - pattern: 'jwt.verify($T, $K, {..., algorithms: [..., "none", ...], ...})'