From df72420cb0f2213df05919458d6f1d6f2e450d0a Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Thu, 22 Dec 2022 16:33:46 +0530
Subject: [PATCH] Create xss-serialize-javascript.yaml

---
 file/nodejs/xss-serialize-javascript.yaml | 26 +++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 file/nodejs/xss-serialize-javascript.yaml

diff --git a/file/nodejs/xss-serialize-javascript.yaml b/file/nodejs/xss-serialize-javascript.yaml
new file mode 100644
index 0000000000..c6944bb728
--- /dev/null
+++ b/file/nodejs/xss-serialize-javascript.yaml
@@ -0,0 +1,26 @@
+id: xss-serialize-javascript
+
+info:
+  name: XSS Serialize Javascript
+  author: me_dheeraj (https://twitter.com/Dheerajmadhukar)
+  severity: info
+  description: Untrusted user input reaching `serialize-javascript` with `unsafe` attribute can cause Cross Site Scripting (XSS).
+  tags: file,nodejs,serialize,xss
+
+file:
+  - extensions:
+      - all
+
+    matchers:
+      - type: regex
+        regex:
+          - "\\$S = require\\('serialize-javascript'\\)"
+          - "\\$S\\(..., {unsafe: true}\\)"
+        condition: or
+
+      - type: regex
+        negative: true
+        regex:
+          - "escape\\(...\\)"
+          - "encodeURI\\(...\\)"
+        condition: or