pattern-either : - patterns : # pattern alone or inside an array - pattern-either : - pattern : | $CORS_SINGLE_ORIGIN - pattern : | [..., $CORS_SINGLE_ORIGIN, ...] - metavariable-pattern : metavariable : $CORS_SINGLE_ORIGIN pattern-either : # <The bad origin checks from the previous figure> Figure 1.7: Semgrep pattern that detects bad CORS origins in a single entry or in an array // Case 1: Has a very permissive 'cors' (true) const apollo_server_bad_1 = new ApolloServer ({ //ruleid: apollo-graphql-v3-bad-cors cors : { origin : true } }); // Case 2: Has a very permissive 'cors' from a variable const bad_CORS_policy = { origin : true } const apollo_server_bad_2 = new ApolloServer ({ //ruleid: apollo-graphql-v3-bad-cors cors : bad_CORS_policy }); // Case 3: Has a very permissive 'cors' from…