@bloodhound-rs/core 0.1.2 → 0.2.1-beta.1.41036880360.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +25 -1
- package/README.md +93 -134
- package/dist/index.d.ts +33 -44
- package/dist/index.js +39 -733
- package/dist/native.d.ts +24 -0
- package/dist/native.js +725 -0
- package/dist/types.d.ts +172 -194
- package/dist/types.js +8 -0
- package/package.json +29 -19
- package/docs/support.md +0 -57
- package/schemas/index.schema.json +0 -464
- package/schemas/report.schema.json +0 -542
package/CHANGELOG.md
CHANGED
|
@@ -1,10 +1,34 @@
|
|
|
1
1
|
# @bloodhound-rs/core
|
|
2
2
|
|
|
3
|
-
## 0.1
|
|
3
|
+
## 0.2.1
|
|
4
4
|
|
|
5
5
|
### Patch Changes
|
|
6
6
|
|
|
7
|
+
- b824b4c: Publish the core, native platform packages, and Rollup plugin with synchronized release metadata and updated platform package descriptions. No runtime API changes.
|
|
8
|
+
|
|
9
|
+
## 0.2.0
|
|
10
|
+
|
|
11
|
+
### Minor Changes
|
|
12
|
+
|
|
13
|
+
- 55094b9: Replace full/compact reports with Manifest v2, a typed Rust resource graph and unified pollution findings. CSS is discovered without scanning CSS rules. Fix global-alias writes, cleanup matching, finite dependency candidates, redirect/import-map context and UTF-16 location performance.
|
|
14
|
+
|
|
15
|
+
This is a breaking pre-1.0 API change: remove report/index/query, checkpoint/resume, JSONL, timing and adapter helpers; use scan/scanHtml/scanJs, version/defaults and dependencyMode instead. Migrate the Rollup/Rolldown plugin to v2 and add per-rule severity configuration.
|
|
16
|
+
|
|
17
|
+
- 5bca92b: Accept HTML and JavaScript strings as source text and return a compact manifest by default. Use explicit file or URL source objects for loading, and `reportFormat: 'full'` for detailed reports and GlobalIndex. Resolve HTML bases and import maps automatically, and report missing bases for relative references in unnamed text.
|
|
18
|
+
|
|
19
|
+
Remove internal hashes and duplicate mutation findings from the default output, group coverage gaps with counts, and retain source locations, dependency edges, global modifications, DOM/CSS findings, and incomplete-scan status. Add JSON stdout examples with caller-owned persistence. Split Rust loading, scheduling, JavaScript analysis, markup parsing, and reporting into focused modules.
|
|
20
|
+
|
|
21
|
+
### Patch Changes
|
|
22
|
+
|
|
23
|
+
- 5bca92b: Handle large scan reports in GlobalIndex, report helpers, and checkpoint inputs by converting report collections record by record. Preserve per-record JSON depth and expansion limits, support large query outputs, and buffer report writes before atomically replacing the output file.
|
|
24
|
+
- 55094b9: External `sourceMappingURL` references now consult `resourceMappings` before loading, so bundlers can supply in-memory source maps alongside in-memory chunks.
|
|
7
25
|
- e814af8: Distribute native binaries as separate optional packages selected by operating system, CPU architecture, and Linux libc. Keep the core package limited to the generated loader, type declarations, and schemas.
|
|
26
|
+
- 5bca92b: Add optional scan timing diagnostics for loading, analysis, record construction, dependency resolution, and report generation, with per-resource durations and JavaScript parser, semantic, and traversal breakdowns.
|
|
27
|
+
- 55094b9: Keep scripts after self-closing SVG/MathML elements visible to HTML scanning, and exclude iframe/srcdoc child globals from recursive analysis. Detect bare global listener calls and pair removals by event and handler reference, independent of receiver, capture and conditions.
|
|
28
|
+
|
|
29
|
+
Use bundler source-map metadata for custom, inline and hidden maps. Include the Rollup plugin in Changesets preparation, package assembly and publishing, including plugin-only releases.
|
|
30
|
+
|
|
31
|
+
- 5bca92b: Keep entry-path pagination stable across repeated queries and reject malformed release repository owners. Add automated Rust, SDK, and release-script regression coverage to CI.
|
|
8
32
|
|
|
9
33
|
## 0.1.1
|
|
10
34
|
|
package/README.md
CHANGED
|
@@ -1,16 +1,8 @@
|
|
|
1
1
|
# @bloodhound-rs/core
|
|
2
2
|
|
|
3
|
-
A Rust SDK
|
|
3
|
+
A Rust-backed SDK that statically scans HTML and JavaScript for writes to shared globals, DOM insertion, and style injection. The result is a JSON-serializable Manifest v2 with source locations, dependency edges, severity, and a shortest entry-to-source chain. Input code is never executed.
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
| ---------------------------------------------------------------------------- | --------------------------- |
|
|
7
|
-
| JavaScript parsing, scopes, aliases, and bounded evaluation | Rust + Oxc |
|
|
8
|
-
| HTML extraction and CSS parsing | Rust + html5gum / cssparser |
|
|
9
|
-
| Fetching, import maps, recursive queues, budgets, cancellation, and recovery | Rust |
|
|
10
|
-
| Global indexes, report diffs, reports, JSONL, and schema validation | Rust |
|
|
11
|
-
| npm loader and method declarations | Generated by napi-rs |
|
|
12
|
-
|
|
13
|
-
Results describe static accesses and potential issues. They do not prove that code executed or modified runtime state. The scanner never executes the code it analyzes.
|
|
5
|
+
CSS files and inline `<style>` blocks are discovered and listed. CSS selectors, custom properties, animations, keyframes, and CSS imports are not analyzed. Direct writes to document-level inline styles remain detectable.
|
|
14
6
|
|
|
15
7
|
## Install
|
|
16
8
|
|
|
@@ -18,167 +10,134 @@ Results describe static accesses and potential issues. They do not prove that co
|
|
|
18
10
|
pnpm add @bloodhound-rs/core
|
|
19
11
|
```
|
|
20
12
|
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
| Platform | Binary package |
|
|
24
|
-
| ------------------- | ------------------------------------- |
|
|
25
|
-
| macOS Apple Silicon | `@bloodhound-rs/core-darwin-arm64` |
|
|
26
|
-
| macOS Intel | `@bloodhound-rs/core-darwin-x64` |
|
|
27
|
-
| Linux glibc ARM64 | `@bloodhound-rs/core-linux-arm64-gnu` |
|
|
28
|
-
| Linux glibc x64 | `@bloodhound-rs/core-linux-x64-gnu` |
|
|
29
|
-
| Windows x64 | `@bloodhound-rs/core-win32-x64-msvc` |
|
|
30
|
-
|
|
31
|
-
The loader uses the architecture of the running Node.js process. Linux musl is not supported. Install dependencies on the target system instead of copying `node_modules` between platforms.
|
|
32
|
-
|
|
33
|
-
## Build
|
|
34
|
-
|
|
35
|
-
Requires Node.js 22+, pnpm 10.20.0, Rust 1.97+, and the platform's C/C++ build tools.
|
|
36
|
-
|
|
37
|
-
```sh
|
|
38
|
-
pnpm install --frozen-lockfile
|
|
39
|
-
pnpm build
|
|
40
|
-
pnpm typecheck
|
|
41
|
-
cargo check --locked
|
|
42
|
-
```
|
|
43
|
-
|
|
44
|
-
`napi build` generates `dist/index.js`, `dist/index.d.ts`, and a platform-specific `.node` file from the exports in `native/src/lib.rs`. `src/types.ts` defines data structures such as reports and emits only `dist/types.d.ts`, with no runtime code. Loading fails if the native binary is missing.
|
|
45
|
-
|
|
46
|
-
## Local examples
|
|
47
|
-
|
|
48
|
-
Run from the repository root:
|
|
49
|
-
|
|
50
|
-
```sh
|
|
51
|
-
pnpm build
|
|
52
|
-
pnpm example
|
|
53
|
-
pnpm example:html
|
|
54
|
-
```
|
|
55
|
-
|
|
56
|
-
| Command | Example | Report |
|
|
57
|
-
| ------------------- | -------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- |
|
|
58
|
-
| `pnpm example` | Scan JavaScript and query global reads, writes, and potential conflicts | `outputs/example/report.json` |
|
|
59
|
-
| `pnpm example:html` | Discover the HTML base URL, import map, inline and external scripts, and styles, then recursively scan module dependencies | `outputs/example-html/report.json` |
|
|
60
|
-
|
|
61
|
-
The examples import the SDK by package name and read local source files without executing them or making network requests. After building, either example can be run independently.
|
|
13
|
+
Requires Node.js 22+. Keep optional dependencies enabled so the native package for the current platform is installed. Supported targets are macOS arm64/x64, Linux glibc arm64/x64, and Windows x64. Linux musl is not supported.
|
|
62
14
|
|
|
63
15
|
## SDK
|
|
64
16
|
|
|
65
17
|
```ts
|
|
66
|
-
import {
|
|
67
|
-
|
|
68
|
-
const
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
dependencyMode: 'recursive',
|
|
72
|
-
scopeKey: 'release-page',
|
|
73
|
-
versions: { scmId: 'artifact-revision' },
|
|
74
|
-
jsonlPath: './scan.jsonl',
|
|
18
|
+
import { scan, scanHtml, scanJs, defaults, version } from '@bloodhound-rs/core';
|
|
19
|
+
|
|
20
|
+
const manifest = await scanHtml(htmlText, {
|
|
21
|
+
resourceUrl: 'https://example.com/page.html',
|
|
22
|
+
budgets: { maxResources: 200, timeoutMs: 60_000 },
|
|
75
23
|
});
|
|
76
24
|
|
|
77
|
-
const
|
|
25
|
+
for (const finding of manifest.findings) {
|
|
26
|
+
const source = manifest.sources.find((s) => s.id === finding.source);
|
|
27
|
+
console.log(finding.severity, finding.rule, finding.target, source?.chain, finding.location);
|
|
28
|
+
}
|
|
78
29
|
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
type: 'content',
|
|
84
|
-
resourceUrl: 'https://example.com/app.js',
|
|
85
|
-
content: 'globalThis.sharedConfig = {};',
|
|
86
|
-
},
|
|
87
|
-
},
|
|
88
|
-
{ scriptMode: 'module', executionEnvironment: 'window' },
|
|
89
|
-
);
|
|
30
|
+
await scanJs('window.shared = 1', { scriptMode: 'module' });
|
|
31
|
+
await scanHtml({ type: 'file', path: './page.html' });
|
|
32
|
+
await scanHtml({ type: 'url', url: 'https://example.com/page.html' });
|
|
33
|
+
await scan([{ kind: 'js', source: { type: 'file', path: './app.js' }, scriptMode: 'module' }]);
|
|
90
34
|
|
|
91
|
-
|
|
92
|
-
for (const target of index.findTargets(['sharedConfig'], 'global-object')) {
|
|
93
|
-
console.log(index.sources(target.targetId));
|
|
94
|
-
console.log(index.entryPaths(target.targetId, { limit: 20 }));
|
|
95
|
-
}
|
|
96
|
-
console.log(index.conflicts());
|
|
35
|
+
process.stdout.write(JSON.stringify(manifest) + '\n');
|
|
97
36
|
```
|
|
98
37
|
|
|
99
|
-
|
|
38
|
+
Strings always mean source text. File paths and URLs use explicit source objects. Content sources accept `{ type: 'content', content, resourceUrl? }`. Supply a logical URL or `baseUrl` to resolve relative references in supplied text. Absolute dependencies and inline scripts can be scanned without a URL.
|
|
100
39
|
|
|
101
|
-
`defaults
|
|
40
|
+
`scan`, `scanHtml`, and `scanJs` return the same `Promise<Manifest>`. JavaScript defaults to `classic`; choose `module` for ESM. HTML script tags determine their own mode. Recursive scanning is the default. `dependencyMode: 'single'` analyzes entries only and lists their dependencies without following them, including inline HTML scripts.
|
|
102
41
|
|
|
103
|
-
|
|
42
|
+
## Findings
|
|
104
43
|
|
|
105
|
-
|
|
44
|
+
| Rule | Examples | Default severity |
|
|
45
|
+
| ---------------------- | ------------------------------------------------------------------------------- | ---------------- |
|
|
46
|
+
| `global-write` | `window.config = …`, classic top-level `var`, sloppy implicit globals | warning |
|
|
47
|
+
| `document-write` | `document.body.className = …`, document attributes | warning |
|
|
48
|
+
| `builtin-mutation` | `Array.prototype.x = …`, `Object.assign = …` | error |
|
|
49
|
+
| `host-api-override` | `window.fetch = …`, `history.pushState = …` | error |
|
|
50
|
+
| `dom-insertion` | `document.body.appendChild(…)`, selected element insertion, `document.write(…)` | warning |
|
|
51
|
+
| `style-injection` | injected `<style>` or stylesheet `<link>`, adopted stylesheets | warning |
|
|
52
|
+
| `document-style-write` | `document.body.style.overflow = …` | warning |
|
|
53
|
+
| `global-listener` | `window.addEventListener(…)`, document listeners | warning |
|
|
54
|
+
| `html-global-style` | `<html style="…">`, `<body style="…">` | info |
|
|
106
55
|
|
|
107
|
-
|
|
56
|
+
Ordinary element `style=` attributes in SSR markup are not findings. Expected browser state changes such as `document.title`, `document.cookie`, and navigation are excluded. A severity label is a default consumer policy, not proof that code is harmful.
|
|
108
57
|
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
58
|
+
An inserted node is suppressed when it is removed later in the same straight-line block, or inside a returned cleanup function. A listener is suppressed when the same file contains a removal with the same event and handler reference. Conditions, source order, receiver and capture do not affect listener pairing. Handler aliases and arguments passed to local helpers are resolved; matching an event alone is insufficient. Inline anonymous callbacks remain outside the listener rule, and `once`/`signal` options count as their own removal mechanisms. Pairing does not prove that teardown executes.
|
|
59
|
+
|
|
60
|
+
The scan follows scripts belonging to the current document. Iframe and `srcdoc` references are listed as `not-followed / iframe-isolated-global`; their child documents and scripts are not loaded or analyzed. SVG/MathML contents are skipped with a coverage gap, and ordinary HTML after a self-closing foreign element remains eligible for scanning.
|
|
112
61
|
|
|
113
|
-
|
|
62
|
+
## Manifest v2
|
|
114
63
|
|
|
115
|
-
|
|
64
|
+
| Field | Meaning |
|
|
65
|
+
| --------------------------------- | ------------------------------------------------------------------------------------ |
|
|
66
|
+
| `schemaVersion`, `scannerVersion` | Format and scanner versions |
|
|
67
|
+
| `status` | `completed`, `partial`, `failed`, or `cancelled` |
|
|
68
|
+
| `dependencyMode` | `single` or `recursive` |
|
|
69
|
+
| `summary` | Source, finding, severity, dependency and gap counts; bytes and scan duration |
|
|
70
|
+
| `entries` | Entry source IDs, in request order |
|
|
71
|
+
| `sources` | Logical URL, kind, mode, status, hash, referrers and shortest source chain |
|
|
72
|
+
| `findings` | Rule, severity, target, operation, confidence, location, snippet and optional detail |
|
|
73
|
+
| `dependencies` | Source/target IDs, specifier, URL, status, reason and discovery location |
|
|
74
|
+
| `gaps` | Coverage limits grouped by source and reason, with occurrence counts |
|
|
116
75
|
|
|
117
|
-
|
|
118
|
-
| -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
119
|
-
| `importMap` / `importMapBaseUrl` | Supply the original page's module mappings and resolution base when scanning JavaScript separately |
|
|
120
|
-
| `resourceUrl` | Supply the original online URL when scanning an offline file |
|
|
121
|
-
| `baseUrl` | Supply a document base when the input lacks one. A valid HTML `<base>` is read automatically |
|
|
122
|
-
| `resourceMappings` | Map resolved resource URLs to local files or source text, such as build artifacts that have not been deployed. This is separate from the HTML import map |
|
|
76
|
+
Lines are 1-based, columns are 0-based UTF-16 units. Inline findings use fragment-relative coordinates; `source.inline` gives their origin in the parent. For a first-line finding, add the origin column; for later lines, use the finding column unchanged. The bundler plugin performs this conversion automatically. Source maps optionally add `location.original`.
|
|
123
77
|
|
|
124
|
-
|
|
78
|
+
CSS dependency edges use `not-followed` with `reason: 'css-not-analyzed'`. CSS dependencies do not create analyzed source records. An explicit `kind: 'css'` entry is loaded and listed with no findings. Unloaded or unparseable JavaScript produces unresolved edges and coverage gaps.
|
|
125
79
|
|
|
126
|
-
|
|
80
|
+
## Offline scans, limits and cancellation
|
|
127
81
|
|
|
128
82
|
```ts
|
|
129
|
-
const
|
|
130
|
-
|
|
83
|
+
const controller = new AbortController();
|
|
84
|
+
const manifest = await scanJs('import "./shared.js";', {
|
|
85
|
+
scriptMode: 'module',
|
|
86
|
+
resourceUrl: 'https://example.com/app.js',
|
|
87
|
+
access: { protocols: [] },
|
|
131
88
|
resourceMappings: {
|
|
132
|
-
'https://example.com/
|
|
133
|
-
type: 'file',
|
|
134
|
-
path: './artifacts/app.js',
|
|
135
|
-
},
|
|
89
|
+
'https://example.com/shared.js': { type: 'content', content: 'window.shared = 1;' },
|
|
136
90
|
},
|
|
137
|
-
|
|
91
|
+
sourceMaps: true,
|
|
92
|
+
signal: controller.signal,
|
|
138
93
|
});
|
|
139
94
|
```
|
|
140
95
|
|
|
141
|
-
|
|
96
|
+
`resourceMappings` supplies content or local files for resolved URLs, including source maps. `access` can restrict schemes, hosts and file roots. `requestHeaders` is keyed by host and optional port. Redirects are checked at every hop. URLs with embedded credentials are rejected.
|
|
142
97
|
|
|
143
|
-
|
|
98
|
+
`excludeUrls` takes regex source strings (Rust regex syntax, no lookaround) such as `['/vendor/', '\\.min\\.js($|\\?)']`. A recursively discovered dependency whose resolved logical URL matches is not loaded or analyzed. It stays visible in `dependencies` as `not-followed` with `reason: 'excluded'` and creates no source record. If an entry itself matches, the scan rejects instead of returning an empty manifest. Inline scripts are not matched.
|
|
144
99
|
|
|
145
|
-
|
|
146
|
-
| ---------------------------------------------------- | --------------------------------------------------------------------------------------------- |
|
|
147
|
-
| `Report` | resources, analysisInstances, references, globalTargets, globalAccesses, findings, unresolved |
|
|
148
|
-
| `jsonlPath` | JSONL written by Rust as resources are processed |
|
|
149
|
-
| `reportPath` | A JSON report written by Rust |
|
|
150
|
-
| `indexArtifact(report)` | A standalone versioned index |
|
|
151
|
-
| `adaptReport(report, 'build' / 'page', metadata)` | A report adapted for build or page integrations |
|
|
152
|
-
| `diffReports(before, after)` | Added and removed items, plus changes to items that can be matched uniquely |
|
|
153
|
-
| `runtimeCandidates(report, evidence)` | Static candidate sources, without treating them as confirmed runtime behavior |
|
|
154
|
-
| `checkpointPath` / `resumeScan(checkpoint, options)` | Save completed records and the pending queue, then fetch and validate inputs again on resume |
|
|
100
|
+
`defaults().budgets` reports resource count, byte, depth, AST-step, candidate, concurrency and timeout limits. Workers each load then analyze one resource; their count is `min(concurrency, analysisConcurrency)`. Cancellation is cooperative. A blocking network request can take up to its request timeout to return. Budget stops and unknown dynamic dependencies remain visible in the manifest.
|
|
155
101
|
|
|
156
|
-
|
|
102
|
+
The scanner tracks local aliases, IIFE parameters, finite string candidates and browser import maps. It does not infer arbitrary function results or cross-module exported values. Worker environments, foreign HTML content and late import maps currently produce explicit coverage gaps. See [supported behavior and limits](docs/support.md).
|
|
157
103
|
|
|
158
|
-
|
|
104
|
+
## Rollup / Rolldown
|
|
159
105
|
|
|
160
|
-
|
|
106
|
+
```js
|
|
107
|
+
import { bloodhound } from '@bloodhound-rs/rollup-plugin';
|
|
161
108
|
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
})
|
|
170
|
-
|
|
171
|
-
|
|
109
|
+
export default {
|
|
110
|
+
input: 'src/main.js',
|
|
111
|
+
output: { dir: 'dist', format: 'es', sourcemap: 'hidden' },
|
|
112
|
+
plugins: [
|
|
113
|
+
bloodhound({
|
|
114
|
+
allowGlobals: ['window.__APP_VERSION__'],
|
|
115
|
+
rules: { 'host-api-override': 'error', 'builtin-mutation': 'error' },
|
|
116
|
+
}),
|
|
117
|
+
],
|
|
118
|
+
};
|
|
172
119
|
```
|
|
173
120
|
|
|
174
|
-
|
|
121
|
+
The plugin scans emitted HTML or entry chunks in memory, follows bundle dependencies, emits `bloodhound.manifest.json`, and maps diagnostics back to original sources. It runs offline by default. See the [plugin documentation](packages/rollup-plugin/README.md).
|
|
122
|
+
|
|
123
|
+
## Manifest Playground
|
|
124
|
+
|
|
125
|
+
Run `pnpm playground` in this repository and open `http://127.0.0.1:4173`. Drop a Manifest v2 JSON file to explore findings, source files, dependency relationships and coverage gaps. Group by rule/type, file, URL folder or entry dependency tree; select any record to see its snippet, location and related files.
|
|
126
|
+
|
|
127
|
+
The viewer processes files locally in the browser. It displays the manifest's evidence and does not infer missing listener cleanup or business application ownership. See the [Playground documentation](playground/README.md) for navigation, build commands and interpretation.
|
|
128
|
+
|
|
129
|
+
## Development and migration
|
|
175
130
|
|
|
176
131
|
```sh
|
|
177
|
-
pnpm
|
|
132
|
+
pnpm install --frozen-lockfile
|
|
133
|
+
pnpm build
|
|
134
|
+
pnpm test
|
|
135
|
+
pnpm example
|
|
136
|
+
pnpm example:html
|
|
137
|
+
pnpm example:rollup
|
|
138
|
+
pnpm example:rolldown
|
|
178
139
|
```
|
|
179
140
|
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
Changesets keeps core and the five binary packages at the same version. The workflow publishes and confirms the binary packages before publishing core with exact optional dependency versions. Run `pnpm changeset` for changes that require a release. See [Releasing](docs/releasing.md) for beta releases, stable releases, and npm authentication.
|
|
141
|
+
The build needs Rust 1.97+ for Oxc 0.154.0. [Architecture](docs/technical-design.md), [tests](docs/testing.md), [verification](docs/verification.md), and [release process](docs/releasing.md) describe the implementation and checks.
|
|
183
142
|
|
|
184
|
-
|
|
143
|
+
Manifest v2 replaces the previous full/compact reports. Global mutations now appear in `findings`; use `status` instead of `scanStatus`, and `gaps` for analysis coverage. The old query/index, checkpoint/resume, report adapters, runtime-candidate helpers, timings, and JSONL APIs are removed. Use `dependencyMode: 'single'` instead of `scanResource`. `version()` replaces the old version helpers. This is a breaking API change.
|
package/dist/index.d.ts
CHANGED
|
@@ -1,46 +1,35 @@
|
|
|
1
|
-
/* Generated by napi-rs. Do not edit. */
|
|
2
|
-
import type { ScanEntry, ScanOptions, Source, Checkpoint, Report, Target, GlobalAccess, AnalysisInstance, Resource, Budgets } from './types.js';
|
|
3
|
-
export * from './types.js';
|
|
4
1
|
/**
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
2
|
+
* `@bloodhound-rs/core` — static scanner for global-environment pollution.
|
|
3
|
+
*
|
|
4
|
+
* Give it an HTML page or a JavaScript file (as text, a file path, or a URL)
|
|
5
|
+
* and it returns a `Manifest` describing every write to the global object,
|
|
6
|
+
* `document`, builtin prototypes and host APIs, every imperative DOM or
|
|
7
|
+
* style insertion, and the resource chain that led to each one.
|
|
8
|
+
*
|
|
9
|
+
* All scanning, loading and resolution run in Rust on a worker thread. The
|
|
10
|
+
* functions here only shape arguments and parse the returned JSON.
|
|
9
11
|
*/
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
export declare function resumeScan(checkpoint: Checkpoint, options?: ScanOptions): Promise<Report>
|
|
35
|
-
|
|
36
|
-
export declare function runtimeCandidates(report: Report, input: { resourceUrl?: string; contentHash?: string; line?: number; column?: number; pathSegments?: string[] }): { accessId: string; attribution: 'static_candidate' }[]
|
|
37
|
-
|
|
38
|
-
export declare function scan(entries: ScanEntry[], options?: ScanOptions): Promise<Report>
|
|
39
|
-
|
|
40
|
-
export declare function scanHtml(input: Source | string, options?: ScanOptions): Promise<Report>
|
|
41
|
-
|
|
42
|
-
export declare function scanJs(input: Source | string, options?: ScanOptions): Promise<Report>
|
|
43
|
-
|
|
44
|
-
export declare function scanResource(entry: ScanEntry, options?: ScanOptions): Promise<Report>
|
|
45
|
-
|
|
46
|
-
export declare function validateReport(report: unknown): asserts report is Report
|
|
12
|
+
import type { Budgets, Manifest, ScanEntry, ScanOptions, Source } from './types.js';
|
|
13
|
+
export type * from './types.js';
|
|
14
|
+
/** Scans any number of entries and returns one manifest. */
|
|
15
|
+
export declare function scan(entries: ScanEntry[], options?: ScanOptions): Promise<Manifest>;
|
|
16
|
+
/**
|
|
17
|
+
* Scans an HTML document. A string is treated as page source; supply
|
|
18
|
+
* `options.resourceUrl` so relative script URLs resolve.
|
|
19
|
+
*/
|
|
20
|
+
export declare function scanHtml(input: Source | string, options?: ScanOptions): Promise<Manifest>;
|
|
21
|
+
/**
|
|
22
|
+
* Scans a JavaScript resource. A string is treated as source text. Set
|
|
23
|
+
* `options.scriptMode` to `'module'` for ESM; the default is `'classic'`.
|
|
24
|
+
*/
|
|
25
|
+
export declare function scanJs(input: Source | string, options?: ScanOptions): Promise<Manifest>;
|
|
26
|
+
/** Scanner, parser and manifest schema versions. */
|
|
27
|
+
export declare function version(): {
|
|
28
|
+
scanner: string;
|
|
29
|
+
parser: string;
|
|
30
|
+
schema: number;
|
|
31
|
+
};
|
|
32
|
+
/** The budgets applied when `options.budgets` is omitted. */
|
|
33
|
+
export declare function defaults(): {
|
|
34
|
+
budgets: Budgets;
|
|
35
|
+
};
|