Documentation
¶
Overview ¶
Package sourcemap_ingest recovers an application's original source from an exposed source map and feeds the routes it names back into the scan.
It is the scanning-phase counterpart to what the discovery crawl does through its asset graph. The two exist separately because they are reached differently: discovery follows a bundle it just fetched, while this module sees one stored response at a time and is the only path that runs at all for `run scan`, for traffic ingested from a proxy, and for Burp/HAR imports — none of which run deparos.
Its relationship to api_spec_ingest is deliberate and close: an exposed source map is the same class of find as an exposed OpenAPI document — a machine-readable description of the application's surface — and is handled the same way, by parsing it and feeding what it describes into the pipeline.
Index ¶
Constants ¶
const ( ModuleID = "sourcemap-ingest" ModuleName = "Source Map Ingest" ModuleShort = "Recovers original source from exposed source maps and ingests its routes for scanning" ModuleDesc = `**What it means:** A JS or CSS bundle's source map is readable anonymously, embedding the original pre-build source and internal file layout. It is found from the ` + "`sourceMappingURL`" + `, a SourceMap header, or the conventional ` + "`<bundle>.map`" + ` path. **How it's exploited:** An attacker reads real source instead of minified output, recovering identifier names, unreferenced admin routes and hardcoded credentials that minification would obscure. Recovered routes are fed back into the scan. **Fix:** Do not deploy ` + "`.map`" + ` files to production. Upload them to the error tracker at build time and delete them from the web root. Stripping the comment leaves it served.` ModuleConfirmation = "The source map was fetched anonymously and parsed as a valid version-3 document. " + "Recovered routes have been ingested into the scanning pipeline." )
Variables ¶
Functions ¶
This section is empty.
Types ¶
type Module ¶
type Module struct {
modkit.BaseActiveModule
// contains filtered or unexported fields
}
Module is the active source-map ingest scanner.
func (*Module) CanProcess ¶
func (m *Module) CanProcess(ctx *httpmsg.HttpRequestResponse) bool
CanProcess accepts responses for assets that can carry a source map.
The gate is the path extension, not the content-type: static hosts label bundles inconsistently, and the sibling probe has to run even on a bundle whose own body says nothing. Matching on the path alone also keeps the gate working for a raw request whose scheme the record has not resolved yet.
func (*Module) IncludesBaseCanProcess ¶
IncludesBaseCanProcess returns false because CanProcess is fully overridden.
func (*Module) ScanPerRequest ¶
func (m *Module) ScanPerRequest( ctx *httpmsg.HttpRequestResponse, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
Source Files