thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/rules/ssrf.json

@@ -1,557 +1,557 @@
-[
-  {
-    "id": "SSRF001",
-    "pattern": "\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*\\w+[Uu][Rr][Ll]\\b|\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*(?:target|url|endpoint|src|source)\\b",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Go: http.Get() with any variable (targetURL, avatarURL, etc.)",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF002",
-    "pattern": "\\bDownloadString\\s*\\(\\s*\\w*[Uu]rl\\b|\\bDownloadString\\s*\\(\\s*(?:url|target|endpoint)\\b",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF003",
-    "pattern": "new\\s+System\\.Uri\\s*\\(\\s*\\w*[Uu]rl\\b|new\\s+Uri\\s*\\(\\s*\\w*(?:[Uu]rl|[Ee]ndpoint|[Ss]ervice)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF004",
-    "pattern": "requests\\.get\\s*\\(\\s*(?:url|URL)\\b|http\\.get\\s*\\([^)]*req\\.|fetchUrl\\s*\\(.*req",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF (original patterns)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF005",
-    "pattern": "got\\s*\\(\\s*(?:url|targetUrl|userUrl)|superagent\\.get\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF (original patterns)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF006",
-    "pattern": "new\\s+URL\\s*\\([^)]*(?:req\\.|request\\.|getParameter|FormValue)\\s*|URL\\.openConnection|URL\\.openStream",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF (original patterns)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF007",
-    "pattern": "HttpClient.*GetAsync\\s*\\(\\s*\\w*[Uu]rl|HttpClient.*PostAsync\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF (original patterns)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF008",
-    "pattern": "fetch\\s*\\(\\s*(?:req\\.|request\\.|url|targetUrl|webhookUrl|userUrl)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "fetch with user URL",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF009",
-    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete|request)\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF010",
-    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete)\\s*\\(\\s*(?:url|source|endpoint|target|webhook|dataUrl|avatar|oembedUrl)\\b",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF011",
-    "pattern": "https?\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|\\bhttps\\s*\\.\\s*get\\s*\\(",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF012",
-    "pattern": "fetch\\s*\\(\\s*(?:dataUrl|endpoint|source|avatarUrl|oembedUrl|callbackUrl|profileUrl)\\b",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF013",
-    "pattern": "httpx\\s*\\.\\s*(?:get|post|AsyncClient|Client)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF014",
-    "pattern": "urllib\\s*\\.\\s*request\\s*\\.\\s*urlopen\\s*\\(",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF015",
-    "pattern": "aiohttp\\s*\\.\\s*ClientSession",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF016",
-    "pattern": "requests\\s*\\.\\s*(?:post|put|head|session)\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF017",
-    "pattern": "http\\s*\\.\\s*Post\\s*\\(\\s*\\w*[Uu]rl|http\\s*\\.\\s*Post\\s*\\(\\s*(?:webhookURL|endpoint)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF018",
-    "pattern": "http\\s*\\.\\s*NewRequest\\s*\\([^)]*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF019",
-    "pattern": "HttpRequest\\s*\\.\\s*newBuilder\\s*\\(\\s*\\)\\s*\\.\\s*uri\\s*\\(",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Java: Java 11 HttpClient / HttpRequest.newBuilder",
-    "language": [
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF020",
-    "pattern": "OkHttpClient\\s*\\(\\s*\\)|Request\\s*\\.\\s*Builder\\s*\\(\\s*\\)\\s*\\.\\s*url\\s*\\(",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF021",
-    "pattern": "httpClient\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|httpClient\\s*\\.\\s*get\\s*\\(\\s*\"",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF022",
-    "pattern": "URL\\s*\\([^)]*\\)\\s*\\.\\s*(?:readBytes|readText|openStream|openConnection)",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF023",
-    "pattern": "new\\s+WebClient\\s*\\(\\s*\\)\\s*\\.\\s*(?:DownloadString|DownloadData|OpenRead)",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF024",
-    "pattern": "WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*[Uu]rl|WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*(?:endpoint|target)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF025",
-    "pattern": "file_get_contents\\s*\\(\\s*\\$[a-zA-Z_]",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF026",
-    "pattern": "curl_init\\s*\\(\\s*\\$[a-zA-Z_]|curl_exec\\s*\\(\\s*\\$[a-zA-Z_]",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF027",
-    "pattern": "Net\\s*::\\s*HTTP\\s*\\.\\s*(?:get|get_response|start)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF028",
-    "pattern": "HTTParty\\s*\\.\\s*(?:get|post)\\s*\\(",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF029",
-    "pattern": "Faraday\\s*\\.\\s*new\\s*\\(",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF030",
-    "pattern": "URI\\s*\\.\\s*open\\s*\\(\\s*\\w*[Uu]rl|URI\\s*\\.\\s*open\\s*\\(\\s*(?:resource|source|target)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF031",
-    "pattern": "RestClient\\s*\\.\\s*(?:get|post)\\s*\\(",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF032",
-    "pattern": "reqwest\\s*::\\s*(?:get|Client)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
-    "language": [
-      "rust"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF033",
-    "pattern": "client\\s*\\.\\s*(?:get|post)\\s*\\(\\s*&?\\s*(?:url|user_url|req\\.|payload\\.)",
-    "flags": "",
-    "category": "ssrf",
-    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
-    "language": [
-      "rust"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF034",
-    "pattern": "new WebClient\\s*\\(\\)|WebRequest\\.Create\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF035",
-    "pattern": "client\\.DownloadString\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF036",
-    "pattern": "_httpClient\\.(?:GetAsync|PostAsync)\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF037",
-    "pattern": "Net::HTTP\\.get_response\\s*\\(",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF038",
-    "pattern": "HTTParty\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|callback|target)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF039",
-    "pattern": "Faraday\\.new\\s*\\(\\s*url:\\s*\\w*(?:[Uu]rl|source_url|feed_url)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF040",
-    "pattern": "RestClient\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|target|host)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF041",
-    "pattern": "URI\\.open\\s*\\(\\s*\\w*(?:[Uu]rl|resource_url|avatar_url)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF042",
-    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|imageUrl)\\b",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "PHP SSRF",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF043",
-    "pattern": "curl_init\\s*\\(\\s*\\$(?:_POST|_GET|url|target|webhook_url)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "PHP SSRF",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF044",
-    "pattern": "http\\.Get\\s*\\(\\s*\\w*(?:[Uu]rl|[Tt]arget|[Ee]ndpoint|[Ww]ebhook|[Aa]vatar)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Go SSRF",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF045",
-    "pattern": "http\\.Post\\s*\\(\\s*\\w*(?:[Uu]rl|[Ww]ebhook)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Go SSRF",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "SSRF046",
-    "pattern": "http\\.NewRequest\\s*\\(\\s*\"GET\"\\s*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
-    "flags": "i",
-    "category": "ssrf",
-    "description": "Go SSRF",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  }
-]
+[
+  {
+    "id": "SSRF001",
+    "pattern": "\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*\\w+[Uu][Rr][Ll]\\b|\\bhttp\\s*\\.\\s*Get\\s*\\(\\s*(?:target|url|endpoint|src|source)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Get() with any variable (targetURL, avatarURL, etc.)",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF002",
+    "pattern": "\\bDownloadString\\s*\\(\\s*\\w*[Uu]rl\\b|\\bDownloadString\\s*\\(\\s*(?:url|target|endpoint)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF003",
+    "pattern": "new\\s+System\\.Uri\\s*\\(\\s*\\w*[Uu]rl\\b|new\\s+Uri\\s*\\(\\s*\\w*(?:[Uu]rl|[Ee]ndpoint|[Ss]ervice)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString(variable), HttpClient BaseAddress from Uri(variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF004",
+    "pattern": "requests\\.get\\s*\\(\\s*(?:url|URL)\\b|http\\.get\\s*\\([^)]*req\\.|fetchUrl\\s*\\(.*req",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF005",
+    "pattern": "got\\s*\\(\\s*(?:url|targetUrl|userUrl)|superagent\\.get\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF006",
+    "pattern": "new\\s+URL\\s*\\([^)]*(?:req\\.|request\\.|getParameter|FormValue)\\s*|URL\\.openConnection|URL\\.openStream",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF007",
+    "pattern": "HttpClient.*GetAsync\\s*\\(\\s*\\w*[Uu]rl|HttpClient.*PostAsync\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF (original patterns)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF008",
+    "pattern": "fetch\\s*\\(\\s*(?:req\\.|request\\.|url|targetUrl|webhookUrl|userUrl)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "fetch with user URL",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF009",
+    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete|request)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF010",
+    "pattern": "axios\\s*\\.\\s*(?:get|post|put|delete)\\s*\\(\\s*(?:url|source|endpoint|target|webhook|dataUrl|avatar|oembedUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF011",
+    "pattern": "https?\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|\\bhttps\\s*\\.\\s*get\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF012",
+    "pattern": "fetch\\s*\\(\\s*(?:dataUrl|endpoint|source|avatarUrl|oembedUrl|callbackUrl|profileUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — JS/TS: axios (get/post/put), https.get, broader fetch patterns",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF013",
+    "pattern": "httpx\\s*\\.\\s*(?:get|post|AsyncClient|Client)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF014",
+    "pattern": "urllib\\s*\\.\\s*request\\s*\\.\\s*urlopen\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF015",
+    "pattern": "aiohttp\\s*\\.\\s*ClientSession",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF016",
+    "pattern": "requests\\s*\\.\\s*(?:post|put|head|session)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Python: httpx, urllib.request, aiohttp, requests.post",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF017",
+    "pattern": "http\\s*\\.\\s*Post\\s*\\(\\s*\\w*[Uu]rl|http\\s*\\.\\s*Post\\s*\\(\\s*(?:webhookURL|endpoint)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF018",
+    "pattern": "http\\s*\\.\\s*NewRequest\\s*\\([^)]*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Go: http.Post, http.NewRequest + client.Do",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF019",
+    "pattern": "HttpRequest\\s*\\.\\s*newBuilder\\s*\\(\\s*\\)\\s*\\.\\s*uri\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Java: Java 11 HttpClient / HttpRequest.newBuilder",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF020",
+    "pattern": "OkHttpClient\\s*\\(\\s*\\)|Request\\s*\\.\\s*Builder\\s*\\(\\s*\\)\\s*\\.\\s*url\\s*\\(",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF021",
+    "pattern": "httpClient\\s*\\.\\s*get\\s*\\(\\s*\\w*[Uu]rl|httpClient\\s*\\.\\s*get\\s*\\(\\s*\"",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF022",
+    "pattern": "URL\\s*\\([^)]*\\)\\s*\\.\\s*(?:readBytes|readText|openStream|openConnection)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Kotlin: OkHttpClient, Ktor httpClient, URL().readBytes, URL composed from host/port",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF023",
+    "pattern": "new\\s+WebClient\\s*\\(\\s*\\)\\s*\\.\\s*(?:DownloadString|DownloadData|OpenRead)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF024",
+    "pattern": "WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*[Uu]rl|WebRequest\\s*\\.\\s*Create\\s*\\(\\s*\\w*(?:endpoint|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — C#: WebClient.DownloadString, WebRequest.Create",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF025",
+    "pattern": "file_get_contents\\s*\\(\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF026",
+    "pattern": "curl_init\\s*\\(\\s*\\$[a-zA-Z_]|curl_exec\\s*\\(\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — PHP: file_get_contents, curl_init/curl_exec",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF027",
+    "pattern": "Net\\s*::\\s*HTTP\\s*\\.\\s*(?:get|get_response|start)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF028",
+    "pattern": "HTTParty\\s*\\.\\s*(?:get|post)\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF029",
+    "pattern": "Faraday\\s*\\.\\s*new\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF030",
+    "pattern": "URI\\s*\\.\\s*open\\s*\\(\\s*\\w*[Uu]rl|URI\\s*\\.\\s*open\\s*\\(\\s*(?:resource|source|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF031",
+    "pattern": "RestClient\\s*\\.\\s*(?:get|post)\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Ruby: Net::HTTP, HTTParty, Faraday, URI.open, RestClient",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF032",
+    "pattern": "reqwest\\s*::\\s*(?:get|Client)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
+    "language": [
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF033",
+    "pattern": "client\\s*\\.\\s*(?:get|post)\\s*\\(\\s*&?\\s*(?:url|user_url|req\\.|payload\\.)",
+    "flags": "",
+    "category": "ssrf",
+    "description": "SSRF — Rust: reqwest::get, reqwest Client builder",
+    "language": [
+      "rust"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF034",
+    "pattern": "new WebClient\\s*\\(\\)|WebRequest\\.Create\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF035",
+    "pattern": "client\\.DownloadString\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF036",
+    "pattern": "_httpClient\\.(?:GetAsync|PostAsync)\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "C# SSRF: WebClient, HttpClient, WebRequest",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF037",
+    "pattern": "Net::HTTP\\.get_response\\s*\\(",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF038",
+    "pattern": "HTTParty\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|callback|target)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF039",
+    "pattern": "Faraday\\.new\\s*\\(\\s*url:\\s*\\w*(?:[Uu]rl|source_url|feed_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF040",
+    "pattern": "RestClient\\.(?:get|post)\\s*\\(\\s*\\w*(?:[Uu]rl|target|host)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF041",
+    "pattern": "URI\\.open\\s*\\(\\s*\\w*(?:[Uu]rl|resource_url|avatar_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Ruby SSRF: Net::HTTP, HTTParty, Faraday, RestClient, URI.open",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF042",
+    "pattern": "file_get_contents\\s*\\(\\s*\\$(?:_GET|_POST|url|imageUrl)\\b",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "PHP SSRF",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF043",
+    "pattern": "curl_init\\s*\\(\\s*\\$(?:_POST|_GET|url|target|webhook_url)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "PHP SSRF",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF044",
+    "pattern": "http\\.Get\\s*\\(\\s*\\w*(?:[Uu]rl|[Tt]arget|[Ee]ndpoint|[Ww]ebhook|[Aa]vatar)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF045",
+    "pattern": "http\\.Post\\s*\\(\\s*\\w*(?:[Uu]rl|[Ww]ebhook)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "SSRF046",
+    "pattern": "http\\.NewRequest\\s*\\(\\s*\"GET\"\\s*,\\s*\\w*(?:[Uu]rl|[Ee]ndpoint)",
+    "flags": "i",
+    "category": "ssrf",
+    "description": "Go SSRF",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  }
+]