1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
|
bypassSecurityTrustHtml[[:space:]]*\(
\.createCipheriv[[:space:]]*\([[:space:]]*['"](DES(-EDE3?)|RC[24]|BF|AES-128-(ECB|CBC))
checkServerIdentity[[:space:]]*:.*
rejectUnauthorized[[:space:]]*:[[:space:]]*[Ff][Aa][Ll][Ss][Ee]
modulusLength[[:space:]]*:[[:space:]]*(256|512|1024)
namedCurve.*secp112r2
secureProtocol.*TLSv1_method
(min|max)Version.*TLSv1.1
\.cookie[[:space:]]*\(.*\.(query|param)
\.location\.hash\.slice[[:space:]]*\(
.innerHTML[[:space:]]*=[^;]*\.(location\.hash|query|param)
require\(['"]adm-zip['"]\)
\.createWriteStream[[:space:]]*\(
\.runIn(New|This)?Context[[:space:]]*\(
\.compileFunction[[:space:]]*\(
\._compile[[:space:]]*\(
eval[[:space:]]*\([^\'\"\)]+\)
eval[[:space:]]*\([[:space:]]*\`.*\$\{[^\}]+\}
\.execSync[[:space:]]*\(
require[[:space:]]*\([[:space:]]*.(child_process|execa).
(spawn|execFile)(Sync)?[[:space:]]\(
\.readFileSync[[:space:]]*\(
dotfiles.?[[:space:]]*:[[:space:]]*['"][Aa][Ll][Ll][Oo][Ww]['"]
\.chmod(Sync)?[[:space:]]*\(
(WHERE|where)[[:space:]]+[^\;:\)]+(=|[Ii][[Nn][[:space:]]+[\+\"\(]).*\$\{
[\'\" ]+AND[[:space:]]+.*=[[:space:]]?\$\{[^\}]+\}
(LIKE|like)[[:space:]]+(['"][^\'\"]*)?\$\{[^\}]+\}
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+[A-Za-z0-9_, -]*\$\{[^\}]+\}
(LIMIT|limit)[[:space:]]+([0-9 ]+,? ?)?\$\{[^\}]+\}
(spawn|execFile|\.exec)(Sync)?[[:space:]]\(.*(\$\{[^\}]+\}|\.query|\.param)
algorithm[[:space:]]*:[[:space:]]*['"][Nn][Oo][Nn][Ee]['"]
\$where:[[:space:]]*`[^`]*\$\{[^\}]+\}
\.redirect[[:space:]]*\(
(WHERE|where)[[:space:]]+.*=.*[\'\"][[:space:]]*\+.*
[\'\" ]+AND[[:space:]]+.*=.*\+.*
(LIKE|like)[[:space:]]+[^\;]+\+.*
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+.*\+.*
(LIMIT|limit)[[:space:]]+([0-9]+,[[:space:]]*.*)
v-html[[:space:]]*=
domPropsInnerHTML[[:space:]]*=
\.parseXmlString[[:space:]]*\(
|
