@contrast/agent 4.2.0

package/lib/assess/policy/rules.json

@@ -0,0 +1,1564 @@
+{
+  "rules": {
+    "ssrf": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "axios": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.request": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.get": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.delete": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.head": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.options": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.post": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 2,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.put": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 2,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "axios.patch": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 2,
+                "depth": 1,
+                "exclusiveKeys": ["method", "url", "baseURL"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "http.get": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": ["axios"],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["host", "hostname", "protocol"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["host", "hostname", "protocol"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "https.get": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": ["axios"],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["host", "hostname", "protocol"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": ["host", "hostname", "protocol"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "http.request": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": ["^(?!.*(newrelic)).*http.*$", "axios"],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": [
+                  "host",
+                  "hostname",
+                  "localAddress",
+                  "protocol"
+                ],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": [
+                  "host",
+                  "hostname",
+                  "localAddress",
+                  "protocol"
+                ],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "https.request": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": ["^(?!.*(newrelic)).*http.*$", "axios"],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "provider": "./sinks/ssrf-url.js",
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["source-type:querystring", "source-type:path"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": [
+                  "host",
+                  "hostname",
+                  "localAddress",
+                  "protocol"
+                ],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "depth": 1,
+                "exclusiveKeys": [
+                  "host",
+                  "hostname",
+                  "localAddress",
+                  "protocol"
+                ],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "http.ClientRequest.prototype.end": {
+          "type": "dataflow",
+          "enabled": false,
+          "__note": "FIXME(CONTRAST-35300. This is called by http/s. This should wait for end and inspect its own properties to ensure host, path, and protocol are not user controlled.)",
+          "stackTrustedLibs": ["^(?!.*(newrelic)).*http.*$", "^(?!.*(newrelic)).*https.*$"]
+        }
+      }
+    },
+    "sql-injection": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "sequelize.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "typeorm.Repository.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "typeorm.Connection.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "mysql/lib/Connection.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["sql"],
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "pg.Connection.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["text"],
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "pg/lib/client.prototype.query": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              },
+              {
+                "index": 0,
+                "depth": 1,
+                "exclusiveKeys": ["text"],
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.all": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.run": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.get": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.each": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.exec": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        },
+        "sqlite3.Database.prototype.prepare": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "requiredTags": ["untrusted"],
+                "disallowedTags": ["sql-encoded", "limited-chars"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "path-traversal": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "fs.access": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.accessSync": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.copyFile": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.copyFileSync": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.appendFile": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.appendFileSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.writeFile": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.writeFileSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.createWriteStream": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.createReadStream": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.unlink": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.unlinkSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.truncate": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.truncateSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.rmdir": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.rmdirSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.rename": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.renameSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readFile": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readFileSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readdir": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readdirSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.open": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.openSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.mkdir": {
+          "enabled": true,
+          "type": "dataflow",
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.mkdirSync": {
+          "hookPhase": "pre",
+          "enabled": true,
+          "type": "dataflow",
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readlink": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.readlinkSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.symlink": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.symlinkSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.chmod": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.chmodSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.lchmod": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.lchmodSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.chown": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.chownSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.lchown": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "fs.lchownSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "unvalidated-redirect": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "express.response.redirect": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": -1,
+                "disallowedTags": ["url-encoded", "html-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "express.response.location": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "html-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "nosql-injection-mongodb": {
+      "enabled": true,
+      "type": "http",
+      "provider": "./sinks/mongodb.js"
+    },
+    "nosql-injection-dynamodb": {
+      "enabled": true,
+      "type": "http",
+      "provider": "./sinks/dynamo.js"
+    },
+    "nosql-injection": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "mongodb.Collection.prototype.rename": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "mongodb.Db.prototype.eval": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "marsdb.Collection.prototype.find": {
+          "tested": "track-order",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 5,
+                "disallowedTags": ["string-type-checked"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "marsdb.Collection.prototype.findOne": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 5,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "marsdb.Collection.prototype.update": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 5,
+                "disallowedTags": ["string-type-checked"],
+                "requiredTags": ["untrusted"]
+              },
+              {
+                "index": 1,
+                "depth": 5,
+                "disallowedTags": ["string-type-checked"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "marsdb.Collection.prototype.insert": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 5,
+                "disallowedTags": ["string-type-checked"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "rethinkdb.js": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "unsafe-code-execution": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "Function": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "eval": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "notevil": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "depth": 1,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "vm.runInContext": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "vm.runInNewContext": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "vm.runInThisContext": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "reflected-xss_hapi16": {
+      "enabled": true,
+      "type": "http",
+      "provider": "./sinks/hapi-16-xss"
+    },
+    "reflected-xss": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "express.response.send": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [
+                  "cookie",
+                  "header",
+                  "limited-chars",
+                  "alphanum-space-hyphen",
+                  "html-encoded",
+                  "sql-encoded",
+                  "url-encoded",
+                  "weak-url-encoded"
+                ],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "swig.compile": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 1,
+                "depth": 1,
+                "disallowedTags": [
+                  "cookie",
+                  "header",
+                  "limited-chars",
+                  "alphanum-space-hyphen",
+                  "html-encoded",
+                  "sql-encoded",
+                  "url-encoded",
+                  "weak-url-encoded"
+                ],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "cmd-injection": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "child_process.spawnSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "child_process.spawn": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "child_process.exec": {
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        },
+        "child_process.execSync": {
+          "hookPhase": "pre",
+          "type": "dataflow",
+          "enabled": true,
+          "stackTrustedLibs": [],
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "xpath-injection": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "xpath.select": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": ["url-encoded", "limited-chars", "alphanum-space-hyphen"],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    },
+    "xxe": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "libxmljs.parseXmlString": {
+          "type": "dataflow",
+          "enabled": true,
+          "provider": "./sinks/libxmljs-xxe.js"
+        },
+        "libxmljs.parseXml": {
+          "type": "dataflow",
+          "enabled": true,
+          "provider": "./sinks/libxmljs-xxe.js"
+        },
+        "libxmljs2.parseXmlString": {
+          "type": "dataflow",
+          "enabled": true,
+          "provider": "./sinks/libxmljs-xxe.js"
+        },
+        "libxmljs2.parseXml": {
+          "type": "dataflow",
+          "enabled": true,
+          "provider": "./sinks/libxmljs-xxe.js"
+        }
+      }
+    },
+    "untrusted-deserialization": {
+      "enabled": true,
+      "type": "hook",
+      "sinks": {
+        "node-serialize.unserialize": {
+          "type": "dataflow",
+          "enabled": true,
+          "conditions": {
+            "mode": "or",
+            "args": [
+              {
+                "index": 0,
+                "disallowedTags": [],
+                "requiredTags": ["untrusted"]
+              }
+            ]
+          }
+        }
+      }
+    }
+  }
+}