message: Add vuln spec examples for SQL Injection and XXE
diff: @@ -44,3 +44,38 @@ vulnerabilities:
  - "/api/Products"
  - "/api/Products/[0-9]*"
  - "#/search"
  + -
  + description: SQL Injection into user login
  + classifiers:
  + - "CWE-74"
  + - "CWE-89"
  + - "A1:2017"
  + - "WASC-19"
  + flags:
  + files:
  + - "login\.js"
  + code:
  + - "sequelize\.query"
  + - "req\.body\.email"
  + - "req\.body\.password"
  + runtime:
  + - "/rest/user/login"
  + - "{email: \".*\", password: \".*\"}"
  + -
  + description: XXE via file upload in user complaints
  + classifiers:
  + - "CWE-611"
  + - "A4:2017"
  + - "WASC-43"
  + flags:
  + files:
  + - "fileUpload\.js"
  + code:
  + - "handleXmlUpload"
  + - "libxml\.parseXml"
  + - "req\.body\.password"
  + - "B2B customer complaints via file upload have been deprecated for security reasons"
  + runtime:
  + - "/file-upload"
  + - "Content-Disposition: form-data; name=\"file\";"
  + - "Content-Type: text/xml"
  