Documentation
¶
Index ¶
- Constants
- func BaseCandidatesInScope(candidates []string, targetHosts []string, ignoreCrossDomain bool) []string
- func CredentialMatcher() jsluice.SecretMatcher
- func ExtractPublicPath(content string) string
- func ExtractScriptReferences(html string, pageURL string) []string
- func ExtractViteChunkNames(content string) []string
- func ExtractWebpackChunkNames(content string) []string
- func LooksLikeHTML(body string, contentType string) bool
- func SortedUnique(values []string) []string
- type Analysis
- type Endpoint
Constants ¶
const DefaultWindowBytes = 256 * 1024
DefaultWindowBytes bounds one parse. tree-sitter recovers poorly on multi-megabyte minified bundles and silently yields nothing, so source is analyzed in windows rather than whole.
const DefaultWindowOverlapBytes = 64 * 1024
DefaultWindowOverlapBytes keeps a call split by a window boundary visible to one of the windows.
const MaxQueryParamValueBytes = 256
MaxQueryParamValueBytes keeps embedded payload-like examples from bloating a JavaScript endpoint record.
Variables ¶
This section is empty.
Functions ¶
func BaseCandidatesInScope ¶
func BaseCandidatesInScope(candidates []string, targetHosts []string, ignoreCrossDomain bool) []string
BaseCandidatesInScope keeps only the origins belonging to an analyzed host or a subdomain of one.
func CredentialMatcher ¶
func CredentialMatcher() jsluice.SecretMatcher
CredentialMatcher reports configuration assignments whose key names a credential and whose value is opaque.
jsluice ships matchers for credentials with a recognisable shape — an AWS key, a GCP key, a JWT. A platform key is just an opaque string, so it is identifiable only by the name it is assigned to, and those names live in configs/enumerate/javascript/credential_keys.json.
func ExtractPublicPath ¶
ExtractPublicPath returns the webpack publicPath a runtime bundle configures, if any.
func ExtractScriptReferences ¶
ExtractScriptReferences returns the JavaScript a page loads, in document order.
Only the bundles the document itself declares are returned. A lazily-loaded chunk is never a script tag — the bundler injects it at runtime and removes the element once it has loaded — so reaching those is the chunk manifest's job, not this one.
func ExtractViteChunkNames ¶
ExtractViteChunkNames returns asset-directory JavaScript paths referenced as string literals.
func ExtractWebpackChunkNames ¶
ExtractWebpackChunkNames returns the file name webpack builds for every chunk its runtime declares.
func LooksLikeHTML ¶
LooksLikeHTML reports a body an HTML parser should read rather than a JavaScript analyzer.
func SortedUnique ¶
SortedUnique returns the unique values of a slice in a stable order.
Types ¶
type Analysis ¶
type Analysis struct {
Endpoints []*Endpoint
Secrets []*enumerate.JavascriptSecret
Origins []string
}
Analysis is everything one JavaScript artifact yielded.
type Endpoint ¶ added in v0.27.1
type Endpoint struct {
Details *enumerate.JavascriptEndpoint
BaseURL string
Rooted bool
}
Endpoint is an extracted endpoint, the origin serving it and whether that origin is established. Both are stages of the extraction: the origin is reported as the application the endpoint sits under, and rooted is not reported at all.
func RootEndpoints ¶
func RootEndpoints(endpoints []*Endpoint, baseCandidates []string, preferHosts []string) []*Endpoint
RootEndpoints resolves relative endpoint literals against the API base the bundle configures.
A bundle states its base once, as configuration, and then concatenates bare paths onto it. Left alone the two never meet: the literal `general/DeleteFile` is not a path the origin serves, and the base alone names no endpoint.
Source Files