<commit_before>var walk = require('acorn/util/walk');

module.exports = function (tree) {
  walk.recursive(tree.data.cfg, {}, {
    CallExpression: function (node, state, c) {
      if (node.callee.name === 'eval') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using eval() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setTimeout') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setTimeout() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setInterval') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setInterval() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setImmediate') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setImmediate() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'execScript') {
        // TODO seconds argument === 'JScript'
        tree.data.problems.push({
          "type": "risk",
          "message": "using execScript() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.type === 'MemberExpression'
                 && node.callee.object.name === 'crypto'
                 && node.callee.property.name === 'generateCRMFRequest') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using crypto.generateCRMFRequest() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      }
    },
    AssignmentExpression: function (node, state, c) {
      if (node.left.type === 'MemberExpression'
          && isScriptDOMElement(node.left.object)
          && node.left.property.name === 'src') {
        tree.data.problems.push({
          "type": "risk",
          "message": "assigning a user controlled value to ScriptElement.src is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      }
    }
  });
};
<commit_msg>AssignmentExpression<commit_after>var walk = require('acorn/util/walk');

module.exports = function (tree) {
  walk.recursive(tree.data.cfg, {}, {
    CallExpression: function (node, state, c) {
      if (node.callee.name === 'eval') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using eval() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setTimeout') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setTimeout() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setInterval') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setInterval() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'setImmediate') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using setImmediate() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.name === 'execScript') {
        // TODO seconds argument === 'JScript'
        tree.data.problems.push({
          "type": "risk",
          "message": "using execScript() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      } else if (node.callee.type === 'MemberExpression'
                 && node.callee.object.name === 'crypto'
                 && node.callee.property.name === 'generateCRMFRequest') {
        tree.data.problems.push({
          "type": "risk",
          "message": "using crypto.generateCRMFRequest() is not safe",
          "weight": 1,
          "position": {
            "start": node.start,
            "end": node.end
          }
        });
      }
    },
    AssignmentExpression: function (node, state, c) {
      if (node.left.type === 'MemberExpression'
          && isUserControlledValue(node.right.object)) {
        if (isScriptDOMElement(node.left.object)
            && (node.left.property.name === 'src'
                || node.left.property.name === 'text'
                || node.left.property.name === 'textContent'
                || node.left.property.name === 'innerText')) {
          tree.data.problems.push({
            'type': 'risk',
            'message': 'assigning a user controlled value to ScriptElement.' + node.left.property.name + ' is not safe',
            'weight': 1,
            'position': {
              'start': node.start,
              'end': node.end
            }
          });
        } else if (isAnyDOMElement(node.left.object)
            && (node.left.property.name === 'on*')) { // TODO replace * with regex or substring
          tree.data.problems.push({
            'type': 'risk',
            'message': 'assigning a user controlled value to DOMNode.' + node.left.property.name + ' is not safe',
            'weight': 1,
            'position': {
              'start': node.start,
              'end': node.end
            }
          });
        }
      }
    }
  });
};

{'fraction_non_alphanumeric': 0.1631297586262757, 'fraction_numerical': 0.0024299368216426373, 'mean_word_length': 1.5220588235294117, 'pattern_counts': {'":': 78, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5698850', 'n_tokens_mistral': 1815, 'n_tokens_neox': 1766, 'n_words': 384}