@guardbee/mcp-reverse-shield 0.0.0-stage → 0.1.1

package/dist/__tests__/live.test.js

@@ -0,0 +1,67 @@
+import { describe, expect, it } from "vitest";
+import { scanUrl } from "../live.js";
+const minified = Array.from({ length: 300 }, (_, i) => `function a${i}(b){return b+${i}}`).join(";");
+const mapWithSources = JSON.stringify({ version: 3, mappings: "AAAA", sources: ["src/checkout/pricing.ts"], sourcesContent: ["export const discount = 0.3"] });
+function site(routes) {
+    const requested = [];
+    const fetchImpl = (async (input) => {
+        const url = String(input);
+        requested.push(url);
+        const body = routes[url];
+        return new Response(body ?? "not found", { status: body === undefined ? 404 : 200 });
+    });
+    return { fetchImpl, requested };
+}
+describe("scanUrl", () => {
+    it("follows a sourceMappingURL to a public map that embeds sources", async () => {
+        const { fetchImpl } = site({
+            "https://shop.example.com/": '<html><script type="module" src="/assets/app.js"></script></html>',
+            "https://shop.example.com/assets/app.js": `${minified}\n//# sourceMappingURL=app.js.map`,
+            "https://shop.example.com/assets/app.js.map": mapWithSources,
+        });
+        const r = await scanUrl("https://shop.example.com/", { fetchImpl });
+        expect(r.findings.map((f) => f.patternId)).toEqual(["sourcemap_embeds_source"]);
+        expect(r.findings[0].match).toContain("https://shop.example.com/assets/app.js.map");
+        expect(r.grade).toBe("F");
+    });
+    it("tries <bundle>.map even when the comment was stripped", async () => {
+        const { fetchImpl } = site({
+            "https://shop.example.com/": '<script src="https://cdn.example.com/app.js?v=3"></script>',
+            "https://cdn.example.com/app.js?v=3": minified,
+            "https://cdn.example.com/app.js.map": JSON.stringify({ version: 3, mappings: "AAAA", sources: ["src/a.ts"] }),
+        });
+        const r = await scanUrl("https://shop.example.com/", { fetchImpl });
+        expect(r.findings.map((f) => f.patternId)).toEqual(["sourcemap_publicly_reachable"]);
+        expect(r.findings[0].match).toContain("not referenced by the bundle, but served");
+    });
+    it("keeps a low reference finding when the referenced map is not served", async () => {
+        const { fetchImpl } = site({
+            "https://shop.example.com/": '<script src="/app.js"></script>',
+            "https://shop.example.com/app.js": `${minified}\n//# sourceMappingURL=app.js.map`,
+        });
+        const r = await scanUrl("https://shop.example.com/", { fetchImpl });
+        expect(r.findings.map((f) => f.patternId)).toEqual(["sourcemap_reference"]);
+    });
+    it("does not fetch third-party scripts, and checks inline scripts", async () => {
+        const { fetchImpl, requested } = site({
+            "https://shop.example.com/": '<script src="https://www.googletagmanager.com/gtag/js"></script><script>window.API="http://10.1.2.3:8080"</script>',
+        });
+        const r = await scanUrl("https://shop.example.com/", { fetchImpl });
+        expect(requested).toEqual(["https://shop.example.com/"]);
+        expect(r.findings.map((f) => f.patternId)).toEqual(["internal_endpoint"]);
+        expect(r.notes).toContain("1 third-party script(s) not checked");
+    });
+    it("caps the number of scripts and reports the rest", async () => {
+        const tags = Array.from({ length: 5 }, (_, i) => `<script src="/c${i}.js"></script>`).join("");
+        const routes = { "https://shop.example.com/": tags };
+        for (let i = 0; i < 5; i++)
+            routes[`https://shop.example.com/c${i}.js`] = minified;
+        const r = await scanUrl("https://shop.example.com/", { fetchImpl: site(routes).fetchImpl, maxScripts: 2 });
+        expect(r.scannedFiles).toBe(2);
+        expect(r.truncated).toBe(true);
+    });
+    it("rejects non-http URLs", async () => {
+        await expect(scanUrl("file:///etc/passwd")).rejects.toThrow(/Only http/);
+    });
+});
+//# sourceMappingURL=live.test.js.map

package/dist/__tests__/live.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"live.test.js","sourceRoot":"","sources":["../../src/__tests__/live.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrG,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE,cAAc,EAAE,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC;AAE/J,SAAS,IAAI,CAAC,MAA8B;IAC1C,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,KAAmB,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,QAAQ,CAAC,IAAI,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC,CAAiB,CAAC;IACnB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC;AAED,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YACzB,2BAA2B,EAAE,mEAAmE;YAChG,wCAAwC,EAAE,GAAG,QAAQ,mCAAmC;YACxF,4CAA4C,EAAE,cAAc;SAC7D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAChF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4CAA4C,CAAC,CAAC;QACpF,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YACzB,2BAA2B,EAAE,4DAA4D;YACzF,oCAAoC,EAAE,QAAQ;YAC9C,oCAAoC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;SAC9G,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACrF,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YACzB,2BAA2B,EAAE,iCAAiC;YAC9D,iCAAiC,EAAE,GAAG,QAAQ,mCAAmC;SAClF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;YACpC,2BAA2B,EAAE,oHAAoH;SAClJ,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAA2B,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,6BAA6B,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC;QACnF,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC3G,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,KAAK,IAAI,EAAE;QACrC,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/native.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=native.test.d.ts.map

package/dist/__tests__/native.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/native.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/native.test.js

@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import { analyzeNative, assessDotnetNames, detectNativeFormat } from "../native.js";
+import { READABLE_DOTNET_NAMES, buildElf64, buildMachO64, buildPe, entitlementsPlist } from "./testFixtures.js";
+const ids = (r) => (r?.findings ?? []).map((f) => f.patternId).sort();
+const N_SECT_LOCAL = 0x0e;
+const N_SECT_EXTERN = 0x0f;
+const N_OSO = 0x66;
+const N_OPT = 0x3c; // the lone "radr://5614542" stab Apple leaves in stripped binaries
+const CS_ADHOC = 0x2;
+const CS_RUNTIME = 0x10000;
+describe("detectNativeFormat", () => {
+    it("recognises ELF, Mach-O, fat Mach-O and PE, and not Java classes", () => {
+        expect(detectNativeFormat(buildElf64({ type: "pie", sections: [] }))).toBe("elf");
+        expect(detectNativeFormat(buildMachO64({}))).toBe("macho");
+        expect(detectNativeFormat(Buffer.from([0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 2]))).toBe("fat-macho");
+        expect(detectNativeFormat(Buffer.from([0xca, 0xfe, 0xba, 0xbe, 0, 0, 0, 61]))).toBeNull(); // Java 17 class file
+        expect(detectNativeFormat(buildPe({}))).toBe("pe");
+        expect(detectNativeFormat(Buffer.from("#!/bin/sh\necho"))).toBeNull();
+    });
+});
+describe("ELF", () => {
+    it("flags a debug, non-PIE, exec-stack, no-RELRO, no-canary build", () => {
+        const elf = buildElf64({
+            type: "exec",
+            sections: [{ name: ".debug_info" }, { name: ".debug_line" }, { name: ".symtab", type: 2, size: 24 * 90, entsize: 24 }],
+            stackFlags: 7,
+            relro: false,
+        });
+        const r = analyzeNative(elf, "app");
+        expect(ids(r)).toEqual(["native_debug_info", "native_no_nx", "native_no_pie", "native_no_relro", "native_no_stack_canary", "native_symbols_not_stripped"]);
+        expect(r.findings.find((f) => f.patternId === "native_symbols_not_stripped").match).toBe(".symtab with 90 entries");
+    });
+    it("passes a stripped, hardened PIE", () => {
+        expect(ids(analyzeNative(buildElf64({ type: "pie", sections: [{ name: ".dynstr" }], extra: "__stack_chk_fail" }), "app"))).toEqual([]);
+    });
+    it("treats a missing PT_GNU_STACK as an executable stack", () => {
+        expect(ids(analyzeNative(buildElf64({ type: "pie", sections: [], stackFlags: null, extra: "__stack_chk_fail" }), "app"))).toEqual(["native_no_nx"]);
+    });
+    it("does not expect a libc canary from Go binaries", () => {
+        expect(ids(analyzeNative(buildElf64({ type: "pie", sections: [{ name: ".gopclntab" }] }), "app"))).toEqual([]);
+    });
+});
+describe("Mach-O", () => {
+    it("flags a debug map, local symbols and missing signature", () => {
+        const r = analyzeNative(buildMachO64({ symbols: [N_OSO, N_OSO, ...Array(12).fill(N_SECT_LOCAL)], signature: null }), "app");
+        expect(ids(r)).toEqual(["native_debug_info", "native_symbols_not_stripped", "native_unsigned"]);
+    });
+    it("ignores Apple's single marker stab and exported symbols", () => {
+        const r = analyzeNative(buildMachO64({ symbols: [N_OPT, ...Array(30).fill(N_SECT_EXTERN)], signature: { flags: CS_RUNTIME } }), "app");
+        expect(ids(r)).toEqual([]);
+    });
+    it("reads hardened runtime, ad-hoc and entitlements from the code signature", () => {
+        const r = analyzeNative(buildMachO64({
+            signature: {
+                flags: CS_ADHOC,
+                entitlements: entitlementsPlist(["com.apple.security.get-task-allow", "com.apple.security.cs.allow-dyld-environment-variables"]),
+            },
+        }), "app");
+        expect(ids(r)).toEqual(["native_adhoc_signed", "native_debuggable_entitlement", "native_injection_entitlement", "native_no_hardened_runtime"]);
+    });
+    it("does not ask Apple platform binaries for the hardened runtime flag", () => {
+        expect(ids(analyzeNative(buildMachO64({ signature: { flags: 0, platform: 1 } }), "ls"))).toEqual([]);
+    });
+    it("checks PIE only for executables", () => {
+        expect(ids(analyzeNative(buildMachO64({ pie: false, signature: { flags: CS_RUNTIME } }), "app"))).toEqual(["native_no_pie"]);
+        expect(ids(analyzeNative(buildMachO64({ filetype: 6, pie: false, signature: { flags: 0 } }), "lib.dylib"))).toEqual([]);
+    });
+});
+describe("PE", () => {
+    it("flags missing ASLR/DEP, an unsigned .exe and a leaked PDB path", () => {
+        const r = analyzeNative(buildPe({ dllCharacteristics: 0, pdbPath: "C:\\Users\\builder\\src\\Shop\\obj\\Release\\Shop.pdb" }), "Shop.exe");
+        expect(ids(r)).toEqual(["native_build_path_leak", "native_no_nx", "native_no_pie", "native_unsigned"]);
+        expect(r.findings.find((f) => f.patternId === "native_build_path_leak").match).toContain("C:\\Users\\builder");
+    });
+    it("passes a signed, hardened executable with a relative PDB name", () => {
+        expect(ids(analyzeNative(buildPe({ signed: true, pdbPath: "Shop.pdb" }), "Shop.exe"))).toEqual([]);
+    });
+    it("does not require Authenticode for DLLs", () => {
+        expect(ids(analyzeNative(buildPe({ dll: true }), "core.dll"))).toEqual([]);
+    });
+});
+describe(".NET", () => {
+    it("flags an assembly with readable metadata and an embedded PDB", () => {
+        const r = analyzeNative(buildPe({ dll: true, embeddedPdb: true, dotnetNames: READABLE_DOTNET_NAMES }), "Shop.dll");
+        expect(r.flavor).toBe("dotnet");
+        expect(ids(r)).toEqual(["dotnet_embedded_pdb", "dotnet_not_obfuscated"]);
+    });
+    it("accepts renamed metadata", () => {
+        const renamed = [...READABLE_DOTNET_NAMES.slice(10), "a", "b", "A", "B", "c", "1", "2", "3"];
+        expect(ids(analyzeNative(buildPe({ dll: true, dotnetNames: renamed }), "Shop.dll"))).toEqual([]);
+    });
+    it("recognises obfuscator markers and non-ASCII renames", () => {
+        expect(assessDotnetNames([...READABLE_DOTNET_NAMES, "ConfusedByAttribute"])).toMatchObject({ obfuscated: true, summary: "obfuscator marker found (ConfuserEx)" });
+        expect(assessDotnetNames([...READABLE_DOTNET_NAMES.slice(5), "\u206a\u206b\u202e", "\u2029\u206f", "\u200b\u200c\u200d", "\u206e"]).obfuscated).toBe(true);
+    });
+    it("does not judge tiny assemblies", () => {
+        expect(assessDotnetNames(["Resources", "String"]).obfuscated).toBe(true);
+    });
+});
+describe("malformed input", () => {
+    it("skips section headers that lie past the end of a truncated file", () => {
+        const elf = buildElf64({ type: "pie", sections: [{ name: ".symtab", type: 2, size: 240, entsize: 24 }] }).subarray(0, 70);
+        expect(ids(analyzeNative(elf, "truncated"))).not.toContain("native_symbols_not_stripped");
+    });
+    it("returns a note instead of throwing when the header itself is cut off", () => {
+        const r = analyzeNative(buildPe({}).subarray(0, 0x90), "cut.exe");
+        expect(r).toMatchObject({ format: "pe", findings: [] });
+        expect(r.notes[0]).toMatch(/^cut\.exe: could not parse pe headers/);
+    });
+});
+//# sourceMappingURL=native.test.js.map

package/dist/__tests__/native.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.test.js","sourceRoot":"","sources":["../../src/__tests__/native.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEhH,MAAM,GAAG,GAAG,CAAC,CAA+C,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAEpH,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,KAAK,GAAG,IAAI,CAAC;AACnB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,mEAAmE;AACvF,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,UAAU,GAAG,OAAO,CAAC;AAE3B,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,qBAAqB;QAChH,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE;IACnB,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,UAAU,CAAC;YACrB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACtH,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAC3J,MAAM,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,6BAA6B,CAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IACtJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5H,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,6BAA6B,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACvI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,GAAG,aAAa,CAAC,YAAY,CAAC;YACnC,SAAS,EAAE;gBACT,KAAK,EAAE,QAAQ;gBACf,YAAY,EAAE,iBAAiB,CAAC,CAAC,mCAAmC,EAAE,wDAAwD,CAAC,CAAC;aACjI;SACF,CAAC,EAAE,KAAK,CAAC,CAAC;QACX,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,4BAA4B,CAAC,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7H,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE;IAClB,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,OAAO,EAAE,uDAAuD,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QAC1I,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,CAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,wBAAwB,CAAE,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE;IACpB,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;QACnH,MAAM,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,OAAO,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7F,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;QAClK,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7J,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,iBAAiB,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1H,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/scanner.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scanner.test.d.ts.map

package/dist/__tests__/scanner.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/scanner.test.js

@@ -0,0 +1,127 @@
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import { afterEach, describe, expect, it } from "vitest";
+import { grade } from "../finding.js";
+import { finding } from "../finding.js";
+import { RULES } from "../rules.js";
+import { scanPath } from "../scanner.js";
+import { buildAsar, buildElf64, buildFuseBinary, buildMachO64 } from "./testFixtures.js";
+const ids = (fs) => fs.map((f) => f.patternId).sort();
+const dirs = [];
+const tmp = () => {
+    const d = mkdtempSync(join(tmpdir(), "rs-scan-"));
+    dirs.push(d);
+    return d;
+};
+afterEach(() => {
+    for (const d of dirs.splice(0))
+        rmSync(d, { recursive: true, force: true });
+});
+function write(root, files) {
+    for (const [p, data] of Object.entries(files)) {
+        const full = join(root, ...p.split("/"));
+        mkdirSync(join(full, ".."), { recursive: true });
+        writeFileSync(full, data);
+    }
+}
+const minified = Array.from({ length: 300 }, (_, i) => `function a${i}(b){return b+${i}}`).join(";");
+describe("scanPath", () => {
+    it("scans a web build output directory and skips node_modules", () => {
+        const root = tmp();
+        write(root, {
+            "dist/assets/index-3f9a.js": `${minified}\n//# sourceMappingURL=index-3f9a.js.map`,
+            "dist/assets/index-3f9a.js.map": JSON.stringify({ version: 3, mappings: "AAAA", sources: ["src/App.tsx"], sourcesContent: ["export default 1"] }),
+            "node_modules/lib/index.js": 'fetch("http://localhost:1")',
+        });
+        const r = scanPath(root);
+        expect(r.kinds).toEqual(["web"]);
+        expect(ids(r.findings)).toEqual(["sourcemap_embeds_source"]);
+        expect(r.grade).toBe("F");
+        expect(r.scannedFiles).toBe(2);
+    });
+    it("finds native binaries by magic bytes regardless of extension", () => {
+        const root = tmp();
+        write(root, {
+            "bin/server": buildElf64({ type: "exec", sections: [{ name: ".debug_info" }], extra: "__stack_chk_fail" }),
+            "README.txt": "not a binary",
+        });
+        const r = scanPath(root);
+        expect(r.kinds).toEqual(["native"]);
+        expect(ids(r.findings)).toEqual(["native_debug_info", "native_no_pie"]);
+    });
+    it("treats an .app with Electron Framework as one unit: fuses, ASAR and main executable", () => {
+        const root = tmp();
+        const app = join(root, "Demo.app");
+        write(app, {
+            "Contents/Frameworks/Electron Framework.framework/Electron Framework": buildFuseBinary("01001100"),
+            "Contents/Resources/app.asar": buildAsar({ "package.json": "{}", "main.js": minified }),
+            "Contents/MacOS/Demo": buildMachO64({ signature: { flags: 0x2 } }),
+        });
+        const r = scanPath(root);
+        expect(ids(r.findings)).toEqual(["native_adhoc_signed", "native_no_hardened_runtime"]);
+        expect(r.kinds.sort()).toEqual(["electron", "native"]);
+        expect(r.notes.join("\n")).toContain("RunAsNode=off");
+    });
+    it("scans a single file target", () => {
+        const root = tmp();
+        write(root, { "app.js.map": JSON.stringify({ version: 3, mappings: "", sources: ["a.ts"] }) });
+        expect(ids(scanPath(join(root, "app.js.map")).findings)).toEqual(["sourcemap_shipped"]);
+    });
+    it("notes unrecognised single files instead of failing", () => {
+        const root = tmp();
+        write(root, { "notes.txt": "hello" });
+        const r = scanPath(join(root, "notes.txt"));
+        expect(r.findings).toEqual([]);
+        expect(r.notes[0]).toContain("not a recognised artifact");
+    });
+    it("stops at maxFiles and says so", () => {
+        const root = tmp();
+        write(root, Object.fromEntries(Array.from({ length: 10 }, (_, i) => [`f${i}.js`, minified])));
+        const r = scanPath(root, { maxFiles: 3 });
+        expect(r.truncated).toBe(true);
+        expect(r.scannedFiles).toBe(3);
+        expect(r.notes.join("\n")).toContain("Stopped after 3 files");
+    });
+    it("honours include and exclude filters", () => {
+        const root = tmp();
+        write(root, { "public/app.js": 'fetch("http://localhost:1")', "vendor/x.js": 'fetch("http://localhost:2")' });
+        expect(scanPath(root, { exclude: ["vendor"] }).findings[0].match).toBe("http://localhost:1");
+        expect(scanPath(root, { include: ["vendor"] }).findings[0].match).toBe("http://localhost:2");
+    });
+    it("throws for a path that does not exist", () => {
+        expect(() => scanPath(join(tmp(), "missing"))).toThrow(/Path not found/);
+    });
+});
+describe("grade", () => {
+    it("grades by the worst finding", () => {
+        expect(grade([])).toBe("A");
+        expect(grade([finding("native_no_relro", "x")])).toBe("B");
+        expect(grade([finding("native_no_pie", "x")])).toBe("C");
+        expect(grade([finding("sourcemap_shipped", "x")])).toBe("D");
+        expect(grade([finding("sourcemap_shipped", "a"), finding("apk_unsigned", "b"), finding("native_debug_info", "c")])).toBe("F");
+        expect(grade([finding("apk_debuggable", "x")])).toBe("F");
+    });
+});
+describe("rule catalog", () => {
+    it("has unique ids and a fix for every check", () => {
+        expect(new Set(RULES.map((r) => r.id)).size).toBe(RULES.length);
+        for (const r of RULES) {
+            expect(r.recommendation.length).toBeGreaterThan(20);
+            expect(r.exposes.length).toBeGreaterThan(20);
+        }
+    });
+});
+describe("scanPath with a trailing slash", () => {
+    it("still treats Foo.app/ as one bundle instead of walking its frameworks", () => {
+        const root = tmp();
+        const app = join(root, "Native.app");
+        write(app, {
+            "Contents/MacOS/Native": buildMachO64({ signature: { flags: 0x10000 } }),
+            "Contents/Frameworks/Third.framework/Third": buildMachO64({ symbols: Array(5).fill(0x0f), signature: null }),
+        });
+        expect(scanPath(`${app}/`).findings).toEqual([]);
+        expect(ids(scanPath(join(app, "Contents")).findings)).toEqual(["native_unsigned"]);
+    });
+});
+//# sourceMappingURL=scanner.test.js.map

package/dist/__tests__/scanner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../../src/__tests__/scanner.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEzF,MAAM,GAAG,GAAG,CAAC,EAA2B,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/E,MAAM,IAAI,GAAa,EAAE,CAAC;AAC1B,MAAM,GAAG,GAAG,GAAG,EAAE;IACf,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AACF,SAAS,CAAC,GAAG,EAAE;IACb,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,IAAY,EAAE,KAAsC;IACjE,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAErG,QAAQ,CAAC,UAAU,EAAE,GAAG,EAAE;IACxB,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE;YACV,2BAA2B,EAAE,GAAG,QAAQ,0CAA0C;YAClF,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjJ,2BAA2B,EAAE,6BAA6B;SAC3D,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE;YACV,YAAY,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YAC1G,YAAY,EAAE,cAAc;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnC,KAAK,CAAC,GAAG,EAAE;YACT,qEAAqE,EAAE,eAAe,CAAC,UAAU,CAAC;YAClG,6BAA6B,EAAE,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;YACvF,qBAAqB,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACvF,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,6BAA6B,EAAE,aAAa,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7F,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE;IACrB,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9H,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,EAAE;YACT,uBAAuB,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;YACxE,2CAA2C,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SAC7G,CAAC,CAAC;QACH,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/testFixtures.d.ts

@@ -0,0 +1,61 @@
+/** Multi-entry ZIP (no CRC, which zip.ts does not check). `beforeCentralDir` is spliced in where an APK Signing Block lives. */
+export declare function buildZip(entries: Array<{
+    name: string;
+    data: Buffer;
+    deflate?: boolean;
+}>, beforeCentralDir?: Buffer): Buffer;
+/** Enough of an APK Signing Block for detection: the magic sits in the 16 bytes before the central directory. */
+export declare function apkSigningBlock(): Buffer;
+export interface AxmlAttrSpec {
+    name: string;
+    resourceId?: number;
+    bool?: boolean;
+    string?: string;
+}
+export declare function buildAxml(elements: Array<{
+    name: string;
+    attrs: AxmlAttrSpec[];
+}>): Buffer;
+export declare function buildDex(descriptors: string[]): Buffer;
+export declare function buildAsar(files: Record<string, string>): Buffer;
+/** A stand-in Electron binary: padding, the fuse sentinel, version 1, then the fuse states. */
+export declare function buildFuseBinary(states: string, padding?: number): Buffer;
+export interface ElfSpec {
+    type: "exec" | "pie" | "shared";
+    sections: Array<{
+        name: string;
+        type?: number;
+        size?: number;
+        entsize?: number;
+    }>;
+    stackFlags?: number | null;
+    relro?: boolean;
+    extra?: string;
+}
+export declare function buildElf64(spec: ElfSpec): Buffer;
+export interface MachOSpec {
+    filetype?: number;
+    pie?: boolean;
+    /** nlist n_type values for the symbol table. */
+    symbols?: number[];
+    signature?: {
+        flags: number;
+        platform?: number;
+        entitlements?: string;
+    } | null;
+}
+export declare function buildMachO64(spec: MachOSpec): Buffer;
+export declare function entitlementsPlist(keys: string[]): string;
+export interface PeSpec {
+    dll?: boolean;
+    dllCharacteristics?: number;
+    signed?: boolean;
+    pdbPath?: string;
+    embeddedPdb?: boolean;
+    /** Names for the .NET #Strings heap; omit for a native PE. */
+    dotnetNames?: string[];
+}
+export declare function buildPe(spec: PeSpec): Buffer;
+/** Plain, descriptive identifiers like an unobfuscated assembly's metadata. */
+export declare const READABLE_DOTNET_NAMES: string[];
+//# sourceMappingURL=testFixtures.d.ts.map

package/dist/__tests__/testFixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"testFixtures.d.ts","sourceRoot":"","sources":["../../src/__tests__/testFixtures.ts"],"names":[],"mappings":"AAKA,gIAAgI;AAChI,wBAAgB,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,gBAAgB,GAAE,MAAwB,GAAG,MAAM,CAqC9I;AAED,iHAAiH;AACjH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,GAAG,MAAM,CAyF1F;AAID,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAwBtD;AAID,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAyB/D;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,SAAO,GAAG,MAAM,CAEtE;AAID,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClF,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAiDhD;AAID,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAChF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAwEpD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAExD;AAID,MAAM,WAAW,MAAM;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgG5C;AAED,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,UAOjC,CAAC"}