modification in detect-angular-sce-disabled-typescript

Sakshis · Sakshis · commit 74db3ba2a894 · 2025-01-01T06:59:47.000Z
diff --git a/rules/typescript/security/detect-angular-sce-disabled-typescript.yml b/rules/typescript/security/detect-angular-sce-disabled-typescript.yml
@@ -11,4 +11,27 @@ note: >-
       - https://docs.angularjs.org/api/ng/service/$sce
       - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
 rule:
- pattern: $sceProvider.enabled(false)
+  kind: expression_statement
+  regex: ^\$sceProvider
+  has:
+    kind: call_expression
+    stopBy: end
+    all:
+      - has:
+          kind: member_expression
+          nthChild: 1
+          all:
+            - has:
+                kind: identifier
+                regex: ^\$sceProvider$
+            - has:
+                kind: property_identifier
+                regex: ^enabled$
+          precedes:
+            kind: arguments
+            has:
+              kind: 'false'
+              nthChild: 1
+            not:
+              has:
+                nthChild: 2
diff --git a/tests/__snapshots__/detect-angular-sce-disabled-typescript-snapshot.yml b/tests/__snapshots__/detect-angular-sce-disabled-typescript-snapshot.yml
@@ -2,21 +2,93 @@ id: detect-angular-sce-disabled-typescript
 snapshots:
   $sceProvider.enabled(false)(false);:
     labels:
-    - source: $sceProvider.enabled(false)
+    - source: $sceProvider.enabled(false)(false);
       style: primary
       start: 0
+      end: 35
+    - source: $sceProvider
+      style: secondary
+      start: 0
+      end: 12
+    - source: enabled
+      style: secondary
+      start: 13
+      end: 20
+    - source: 'false'
+      style: secondary
+      start: 21
+      end: 26
+    - source: (false)
+      style: secondary
+      start: 20
+      end: 27
+    - source: $sceProvider.enabled
+      style: secondary
+      start: 0
+      end: 20
+    - source: $sceProvider.enabled(false)
+      style: secondary
+      start: 0
       end: 27
   ? |
     $sceProvider.enabled(false).someFunction(true).anything("anything");
   : labels:
-    - source: $sceProvider.enabled(false)
+    - source: $sceProvider.enabled(false).someFunction(true).anything("anything");
       style: primary
       start: 0
+      end: 68
+    - source: $sceProvider
+      style: secondary
+      start: 0
+      end: 12
+    - source: enabled
+      style: secondary
+      start: 13
+      end: 20
+    - source: 'false'
+      style: secondary
+      start: 21
+      end: 26
+    - source: (false)
+      style: secondary
+      start: 20
+      end: 27
+    - source: $sceProvider.enabled
+      style: secondary
+      start: 0
+      end: 20
+    - source: $sceProvider.enabled(false)
+      style: secondary
+      start: 0
       end: 27
   ? |
     $sceProvider.enabled(false);
   : labels:
-    - source: $sceProvider.enabled(false)
+    - source: $sceProvider.enabled(false);
       style: primary
       start: 0
+      end: 28
+    - source: $sceProvider
+      style: secondary
+      start: 0
+      end: 12
+    - source: enabled
+      style: secondary
+      start: 13
+      end: 20
+    - source: 'false'
+      style: secondary
+      start: 21
+      end: 26
+    - source: (false)
+      style: secondary
+      start: 20
+      end: 27
+    - source: $sceProvider.enabled
+      style: secondary
+      start: 0
+      end: 20
+    - source: $sceProvider.enabled(false)
+      style: secondary
+      start: 0
       end: 27
