thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/rules/xss.json

@@ -1,641 +1,663 @@
-[
-  {
-    "id": "XSS001",
-    "pattern": "from\\s+mako\\s*\\.\\s*template\\s+import\\s+Template",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: Mako Template().render() — multiline template then render (separate lines)",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS002",
-    "pattern": "innerHTML\\s*=|document\\.write\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS (original)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS003",
-    "pattern": "render_template_string\\s*\\(|webView.*javaScriptEnabled\\s*=\\s*true",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS (original)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS004",
-    "pattern": "dangerouslySetInnerHTML\\s*=\\s*\\{\\{?\\s*__html\\s*:",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS005",
-    "pattern": "\\[innerHTML\\]\\s*=",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS006",
-    "pattern": "v-html\\s*=",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS007",
-    "pattern": "\\$\\s*\\([^)]+\\)\\s*\\.\\s*html\\s*\\(\\s*\\w",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS008",
-    "pattern": "\\.outerHTML\\s*=",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS009",
-    "pattern": "\\{\\{\\{[^}]+\\}\\}\\}",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS010",
-    "pattern": "marked\\s*\\(\\s*\\w",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS011",
-    "pattern": "res\\s*\\.\\s*(?:send|end|write)\\s*\\(\\s*`[^`]*\\$\\{",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Express res.send/res.end/res.write with template literal containing user input",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS012",
-    "pattern": "make_response\\s*\\(\\s*f['\"]|HttpResponse\\s*\\(\\s*f['\"]",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS013",
-    "pattern": "HTMLResponse\\s*\\(\\s*content\\s*=\\s*f['\"]",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS014",
-    "pattern": "Template\\s*\\([^)]*\\)\\s*\\.render\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS015",
-    "pattern": "\\|\\s*safe\\b",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS016",
-    "pattern": "ERB\\s*\\.\\s*new\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Ruby: ERB.new with user-controlled template",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS017",
-    "pattern": "<\\?=\\s*\\$[a-zA-Z_]",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — PHP: short echo tags",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS018",
-    "pattern": "io\\s*\\.\\s*WriteString\\s*\\(\\s*w\\b",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS019",
-    "pattern": "template\\s*\\.\\s*HTML\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS020",
-    "pattern": "Response\\s*\\.\\s*Write\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS021",
-    "pattern": "new\\s+HtmlString\\s*\\(|Html\\s*\\.\\s*Raw\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS022",
-    "pattern": "return\\s+Content\\s*\\([^,]+,\\s*[\"']text\\/html[\"']",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS023",
-    "pattern": "webView\\s*\\.\\s*loadData\\s*\\(|webView\\s*\\.\\s*loadDataWithBaseURL\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS024",
-    "pattern": "allowUniversalAccessFromFileURLs\\s*=\\s*true",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS025",
-    "pattern": "call\\s*\\.\\s*respondText\\s*\\([^)]*text\\/html",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS026",
-    "pattern": "req\\s*\\.\\s*getHeader\\s*\\(|out\\s*\\.\\s*println\\s*\\([^)]*getParameter",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Java: req.getHeader reflection, PrintWriter with getParameter or string concat",
-    "language": [
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS027",
-    "pattern": "out\\s*\\.\\s*(?:print|println)\\s*\\([^)]*[\"'<][^)]*\\+\\s*\\w|pw\\s*\\.\\s*write\\s*\\([^)]*\\+",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Java: out.print/println/pw.write with string concatenation (variable + HTML)",
-    "language": [
-      "java"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS028",
-    "pattern": "fmt\\s*\\.\\s*Fprintf\\s*\\(\\s*w\\s*,",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Go: fmt.Fprintf(w, \"...%s...\", userVar) — format string with w as target",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS029",
-    "pattern": "fmt\\s*\\.\\s*Fprint\\s*\\(\\s*w\\s*,",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Go: fmt.Fprint(w, ...) with user data",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS030",
-    "pattern": "return\\s+make_response\\s*\\(html\\b|return\\s+HTMLResponse\\s*\\(content\\s*=\\s*html\\b",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Python: make_response/HTMLResponse with variable html built from f-string (multiline pattern)",
-    "language": [
-      "python"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS031",
-    "pattern": "\"[^\"]*#\\{[^}]+\\}[^\"]*\"|'[^']*#\\{[^}]+\\}[^']*'",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Ruby: Sinatra route returning string with interpolation #{...}",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS032",
-    "pattern": "call\\s*\\.\\s*respondText\\s*\\(\\s*\\w",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Kotlin: call.respondText with HTML variable (not just ContentType inline)",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS033",
-    "pattern": "ErrorMessage\\s*=\\s*\\$['\"]",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — C#: @Html.Raw rendered from model property (ErrorMessage / body variable)",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS034",
-    "pattern": "echo\\s+.*\\$(?:_POST|_GET|_REQUEST|_COOKIE|comment|username|data|error)",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS - PHP echo with $_POST/$_GET",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS035",
-    "pattern": "(?:print_r|var_dump)\\s*\\(\\s*\\$_(?:REQUEST|GET|POST)",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS - PHP print_r/var_dump user input",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS036",
-    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS - concatenation into HTML echo",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS037",
-    "pattern": "(?:w\\.Write|fmt\\.Fprintf\\s*\\(\\s*w)[^;]*(?:r\\.URL\\.Query\\(\\)|r\\.FormValue|r\\.Header)",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS - Go w.Write/fmt.Fprintf with user input",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS038",
-    "pattern": "evaluateJavascript\\s*\\(|webView\\.loadUrl\\s*\\(|addJavascriptInterface\\s*\\(",
-    "flags": "i",
-    "category": "xss",
-    "description": "XSS - Kotlin WebView evaluateJavascript",
-    "language": [
-      "kotlin"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS039",
-    "pattern": "\\.html_safe\\b|raw\\s*\\(",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS - Ruby on Rails raw/html_safe with user content",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS040",
-    "pattern": "Response\\.Write\\s*\\([^)]*(?:Request\\.|QueryString|Form\\[)",
-    "flags": "i",
-    "category": "xss",
-    "description": "C# XSS: Response.Write with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS041",
-    "pattern": "context\\.Response\\.Write\\s*\\([^)]*(?:\\+\\s*\\w|\\bname\\b|\\bq\\b)",
-    "flags": "i",
-    "category": "xss",
-    "description": "C# XSS: Response.Write with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS042",
-    "pattern": "Response\\.Write\\s*\\(\"[^\"]*\"\\s*\\+",
-    "flags": "i",
-    "category": "xss",
-    "description": "C# XSS: Response.Write with user input",
-    "language": [
-      "csharp"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS043",
-    "pattern": "render\\s+html:\\s*\\w+\\.html_safe",
-    "flags": "i",
-    "category": "xss",
-    "description": "Ruby XSS: html_safe / raw()",
-    "language": [
-      "ruby"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS044",
-    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|name|query|msg|error|comment)",
-    "flags": "i",
-    "category": "xss",
-    "description": "PHP XSS: echo without htmlspecialchars",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS045",
-    "pattern": "<\\?=\\s*\\$(?:username|profile|bio|color|font|theme|src|href)",
-    "flags": "i",
-    "category": "xss",
-    "description": "PHP XSS: echo without htmlspecialchars",
-    "language": [
-      "php"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS046",
-    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.URL\\.Query\\(\\)\\.Get\\b",
-    "flags": "i",
-    "category": "xss",
-    "description": "Go XSS",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS047",
-    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.FormValue\\b",
-    "flags": "i",
-    "category": "xss",
-    "description": "Go XSS",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS048",
-    "pattern": "template\\.HTML\\s*\\([^)]*\\+\\s*\\w",
-    "flags": "i",
-    "category": "xss",
-    "description": "Go XSS",
-    "language": [
-      "go"
-    ],
-    "severity": "high"
-  },
-  {
-    "id": "XSS049",
-    "pattern": "res\\s*\\.\\s*send\\s*\\(\\s*['\"`].*\\+",
-    "flags": "",
-    "category": "xss",
-    "description": "XSS — Express res.send() with string concatenation containing user input",
-    "language": [
-      "js",
-      "ts"
-    ],
-    "severity": "high"
-  }
-]
+[
+  {
+    "id": "XSS001",
+    "pattern": "from\\s+mako\\s*\\.\\s*template\\s+import\\s+Template",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Mako Template().render() — multiline template then render (separate lines)",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS002",
+    "pattern": "innerHTML\\s*=|document\\.write\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS003",
+    "pattern": "render_template_string\\s*\\(|webView.*javaScriptEnabled\\s*=\\s*true",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS (original)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS004",
+    "pattern": "dangerouslySetInnerHTML\\s*=\\s*\\{\\{?\\s*__html\\s*:",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS005",
+    "pattern": "\\[innerHTML\\]\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS006",
+    "pattern": "v-html\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — React dangerouslySetInnerHTML, Angular [innerHTML], Vue v-html",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS007",
+    "pattern": "\\$\\s*\\([^)]+\\)\\s*\\.\\s*html\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS008",
+    "pattern": "\\.outerHTML\\s*=",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS009",
+    "pattern": "\\{\\{\\{[^}]+\\}\\}\\}",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS010",
+    "pattern": "marked\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — jQuery .html() with variable, outerHTML, Handlebars triple-stache, marked()",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS011",
+    "pattern": "res\\s*\\.\\s*(?:send|end|write)\\s*\\(\\s*`[^`]*\\$\\{",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Express res.send/res.end/res.write with template literal containing user input",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS012",
+    "pattern": "make_response\\s*\\(\\s*f['\"]|HttpResponse\\s*\\(\\s*f['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS013",
+    "pattern": "HTMLResponse\\s*\\(\\s*content\\s*=\\s*f['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS014",
+    "pattern": "Template\\s*\\([^)]*\\)\\s*\\.render\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS015",
+    "pattern": "\\|\\s*safe\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: Flask make_response, Django HttpResponse, FastAPI HTMLResponse with f-string; Mako Template; Jinja2 |safe",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS016",
+    "pattern": "ERB\\s*\\.\\s*new\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Ruby: ERB.new with user-controlled template",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS017",
+    "pattern": "<\\?=\\s*\\$[a-zA-Z_]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — PHP: short echo tags",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS018",
+    "pattern": "io\\s*\\.\\s*WriteString\\s*\\(\\s*w\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS019",
+    "pattern": "template\\s*\\.\\s*HTML\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: io.WriteString to ResponseWriter, template.HTML() cast bypassing escaping",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS020",
+    "pattern": "Response\\s*\\.\\s*Write\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS021",
+    "pattern": "new\\s+HtmlString\\s*\\(|Html\\s*\\.\\s*Raw\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS022",
+    "pattern": "return\\s+Content\\s*\\([^,]+,\\s*[\"']text\\/html[\"']",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: Response.Write, HtmlString, Html.Raw, Content(\"text/html\")",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS023",
+    "pattern": "webView\\s*\\.\\s*loadData\\s*\\(|webView\\s*\\.\\s*loadDataWithBaseURL\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS024",
+    "pattern": "allowUniversalAccessFromFileURLs\\s*=\\s*true",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS025",
+    "pattern": "call\\s*\\.\\s*respondText\\s*\\([^)]*text\\/html",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: WebView.loadData, loadDataWithBaseURL, allowUniversalAccessFromFileURLs, Ktor respondText",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS026",
+    "pattern": "req\\s*\\.\\s*getHeader\\s*\\(|out\\s*\\.\\s*println\\s*\\([^)]*getParameter",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Java: req.getHeader reflection, PrintWriter with getParameter or string concat",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS027",
+    "pattern": "out\\s*\\.\\s*(?:print|println)\\s*\\([^)]*[\"'<][^)]*\\+\\s*\\w|pw\\s*\\.\\s*write\\s*\\([^)]*\\+",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Java: out.print/println/pw.write with string concatenation (variable + HTML)",
+    "language": [
+      "java"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS028",
+    "pattern": "fmt\\s*\\.\\s*Fprintf\\s*\\(\\s*w\\s*,",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: fmt.Fprintf(w, \"...%s...\", userVar) — format string with w as target",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS029",
+    "pattern": "fmt\\s*\\.\\s*Fprint\\s*\\(\\s*w\\s*,",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Go: fmt.Fprint(w, ...) with user data",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS030",
+    "pattern": "return\\s+make_response\\s*\\(html\\b|return\\s+HTMLResponse\\s*\\(content\\s*=\\s*html\\b",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Python: make_response/HTMLResponse with variable html built from f-string (multiline pattern)",
+    "language": [
+      "python"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS031",
+    "pattern": "\"[^\"]*#\\{[^}]+\\}[^\"]*\"|'[^']*#\\{[^}]+\\}[^']*'",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Ruby: Sinatra route returning string with interpolation #{...}",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS032",
+    "pattern": "call\\s*\\.\\s*respondText\\s*\\(\\s*\\w",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Kotlin: call.respondText with HTML variable (not just ContentType inline)",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS033",
+    "pattern": "ErrorMessage\\s*=\\s*\\$['\"]",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — C#: @Html.Raw rendered from model property (ErrorMessage / body variable)",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS034",
+    "pattern": "echo\\s+.*\\$(?:_POST|_GET|_REQUEST|_COOKIE|comment|username|data|error)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - PHP echo with $_POST/$_GET",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS035",
+    "pattern": "(?:print_r|var_dump)\\s*\\(\\s*\\$_(?:REQUEST|GET|POST)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - PHP print_r/var_dump user input",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS036",
+    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - concatenation into HTML echo",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS037",
+    "pattern": "(?:w\\.Write|fmt\\.Fprintf\\s*\\(\\s*w)[^;]*(?:r\\.URL\\.Query\\(\\)|r\\.FormValue|r\\.Header)",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - Go w.Write/fmt.Fprintf with user input",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS038",
+    "pattern": "evaluateJavascript\\s*\\(|webView\\.loadUrl\\s*\\(|addJavascriptInterface\\s*\\(",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS - Kotlin WebView evaluateJavascript",
+    "language": [
+      "kotlin"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS039",
+    "pattern": "\\.html_safe\\b|raw\\s*\\(",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS - Ruby on Rails raw/html_safe with user content",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS040",
+    "pattern": "Response\\.Write\\s*\\([^)]*(?:Request\\.|QueryString|Form\\[)",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS041",
+    "pattern": "context\\.Response\\.Write\\s*\\([^)]*(?:\\+\\s*\\w|\\bname\\b|\\bq\\b)",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS042",
+    "pattern": "Response\\.Write\\s*\\(\"[^\"]*\"\\s*\\+",
+    "flags": "i",
+    "category": "xss",
+    "description": "C# XSS: Response.Write with user input",
+    "language": [
+      "csharp"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS043",
+    "pattern": "render\\s+html:\\s*\\w+\\.html_safe",
+    "flags": "i",
+    "category": "xss",
+    "description": "Ruby XSS: html_safe / raw()",
+    "language": [
+      "ruby"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS044",
+    "pattern": "echo\\s+[\"'][^\"']*[\"']\\s*\\.\\s*\\$(?:_GET|_POST|name|query|msg|error|comment)",
+    "flags": "i",
+    "category": "xss",
+    "description": "PHP XSS: echo without htmlspecialchars",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS045",
+    "pattern": "<\\?=\\s*\\$(?:username|profile|bio|color|font|theme|src|href)",
+    "flags": "i",
+    "category": "xss",
+    "description": "PHP XSS: echo without htmlspecialchars",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS046",
+    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.URL\\.Query\\(\\)\\.Get\\b",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS047",
+    "pattern": "fmt\\.Fprintf\\s*\\(\\s*w[^)]*r\\.FormValue\\b",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS048",
+    "pattern": "template\\.HTML\\s*\\([^)]*\\+\\s*\\w",
+    "flags": "i",
+    "category": "xss",
+    "description": "Go XSS",
+    "language": [
+      "go"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS049",
+    "pattern": "res\\s*\\.\\s*send\\s*\\(\\s*['\"`].*\\+",
+    "flags": "",
+    "category": "xss",
+    "description": "XSS — Express res.send() with string concatenation containing user input",
+    "language": [
+      "js",
+      "ts"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS050",
+    "pattern": "print\\s+\\$(?:_GET|_POST|_REQUEST|_COOKIE|_SERVER)\\[",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS — PHP: print with raw superglobal (unescaped user input)",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  },
+  {
+    "id": "XSS051",
+    "pattern": "echo\\s+[\"'][^\"']*(?:href|src|action|value|data)=[\"']?[^\"'>]*[\"']?\\s*\\.\\s*\\$[a-zA-Z_]",
+    "flags": "i",
+    "category": "xss",
+    "description": "XSS — PHP: echo with user variable injected into HTML attribute (href/src/action)",
+    "language": [
+      "php"
+    ],
+    "severity": "high"
+  }
+]