✏ EDIT: 934100.ra

##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##! Note that the rule uses `multiMatch` and `removeWhitespace.
##! The explicit white space matches will be matched before
##! `removeWhitespace` is applied, everything else will be matched
##! after white space removal.

##!> define js-prop-start \[['\"`]
##!> define js-prop-start-dynamic \[
##!> define js-prop-finish ['\"`]\]

##! node-serialize serialized function flag
_\$\$ND_FUNC\$\$_
__js_function
\beval$
String\.fromCharCode
function\(${
new\s+Function\s*$
this\.constructor
module\.exports=
\(\s*\Wchild_process\W\s*$

##!> assemble
  \(
  \.call\(
  ##!=< js-call
##!<

##! All "process" method names
##! Note that `sync` will be appended optionally to all, as many
##! of the names have a twin with the `sync` suffix.
##!> assemble
  access
  appendfile
  argv
  availability
  caveats
  chmod
  chown
  close
  copyfile
  cp
  createreadstream
  createwritestream
  exec
  execfile
  exists
  fchmod
  fchown
  fdata
  ##! yes, fdatasyncsync
  fdatasync
  fstat
  ##! yes, fsyncsync
  fsync
  futimes
  inodes
  lchmod
  link
  lstat
  lutimes
  mkdir
  mkdtemp
  open
  opendir
  read
  readdir
  readfile
  readlink
  readv
  rename
  rm
  spawn
  spawnfile
  stat
  symlink
  truncate
  unlink
  unwatchfile
  utimes
  watchfile
  writefile
  write
  writev
  ##!=>
  (?:sync)?
  ##!=< process-funcs
##!<

##! All "process" prop names
##!> assemble
  binding
  constructor
  env
  global
  main
  mainModule
  process
  require
  ##!=< process-props
##!<

##! All "console" method names
##!> assemble
  debug
  error
  info
  trace
  warn
  ##!=< console-funcs
##!<

##! All "require" method names
##!> assemble
  resolve
  ##!=< require-funcs
##!<

##! All "require" property names
##!> assemble
  main
  extensions
  cache
  ##!=< require-props
##!<

##! "process" payloads
##!> assemble
  process
  ##!=>

##! Match method calls via their usual syntax: foo.bar()
  ##!> assemble
    \.
    ##!=>
    ##!=> process-funcs
    ##!=> js-call
  ##!<

##! Match properties via their usual syntax: foo.bar
  ##!> assemble
    \.
    ##!=>
    ##!=> process-props
  ##!<

##! Match properties functions via: foo["bar"]
  ##!> assemble
    {{js-prop-start}}
    ##!=>
    ##!> assemble
      ##!=> process-funcs
    ##!<
    ##!> assemble
      ##!=> process-props
    ##!<
    ##!=>
    {{js-prop-finish}}
  ##!<
##!<

##! Match dynamic property access: process[req.query.a]
##! Note that we don't require `process` as a prefix here
##!> assemble
  ##!=> process-props
  {{js-prop-start-dynamic}}
##!<

##! "console" payloads
##!> assemble
  console
  ##!=>

##! Match method calls via their usual syntax: foo.bar()
  ##!> assemble
    \.
    ##!=>
    ##!=> console-funcs
    ##!=> js-call
  ##!<

##! Match properties and functions via: foo["bar"]
  ##!> assemble
    {{js-prop-start}}
    ##!=>
    ##!=> console-funcs
    ##!=>
    {{js-prop-finish}}
  ##!<
##!<

##! "require" payloads
##!> assemble
  require
  ##!=>

##! Match method calls via their usual syntax: foo.bar()
  ##!> assemble
    \.
    ##!=>
    ##!=> require-funcs
    ##!=> js-call
  ##!<

##! Match properties via their usual syntax: foo.bar
  ##!> assemble
    \.
    ##!=>
    ##!=> require-props
  ##!<

##! Match properties and functions via: foo["bar"]
  ##!> assemble
    {{js-prop-start}}
    ##!=>
    ##!> assemble
      ##!=> require-funcs
    ##!<
    ##!> assemble
      ##!=> require-props
    ##!<
    ##!=>
    {{js-prop-finish}}
  ##!<
##!<

[✗] CANCEL