@js-recon/js-recon 1.3.1-beta.2

package/build/analyze/helpers/engineHelpers/taintFlow.js

@@ -0,0 +1,250 @@
+import _traverse from "@babel/traverse";
+const traverse = _traverse.default;
+const memberChainString = (node) => {
+    if (node.type === "Identifier")
+        return node.name;
+    if (node.type === "ThisExpression")
+        return "this";
+    if (node.type === "MemberExpression") {
+        if (node.computed)
+            return null;
+        if (node.property.type !== "Identifier")
+            return null;
+        const obj = memberChainString(node.object);
+        if (!obj)
+            return null;
+        return `${obj}.${node.property.name}`;
+    }
+    return null;
+};
+const collectIdsFromPattern = (node) => {
+    if (!node)
+        return [];
+    if (node.type === "Identifier")
+        return [node.name];
+    if (node.type === "ObjectPattern") {
+        return node.properties.flatMap((p) => {
+            if (p.type === "ObjectProperty")
+                return collectIdsFromPattern(p.value);
+            if (p.type === "RestElement")
+                return collectIdsFromPattern(p.argument);
+            return [];
+        });
+    }
+    if (node.type === "ArrayPattern") {
+        return node.elements.flatMap((e) => (e ? collectIdsFromPattern(e) : []));
+    }
+    if (node.type === "AssignmentPattern")
+        return collectIdsFromPattern(node.left);
+    if (node.type === "RestElement")
+        return collectIdsFromPattern(node.argument);
+    return [];
+};
+const expressionIsTainted = (path, taint) => {
+    if (taint.sourceNodes.has(path.node))
+        return true;
+    let tainted = false;
+    const visit = (p) => {
+        if (tainted)
+            return;
+        if (taint.sourceNodes.has(p.node)) {
+            tainted = true;
+            p.stop();
+            return;
+        }
+        if (p.node.type === "Identifier") {
+            // skip identifiers that are property keys / declarations themselves
+            const parent = p.parent;
+            if (parent &&
+                ((parent.type === "MemberExpression" && parent.property === p.node && !parent.computed) ||
+                    (parent.type === "ObjectProperty" && parent.key === p.node && !parent.computed) ||
+                    (parent.type === "VariableDeclarator" && parent.id === p.node) ||
+                    (parent.type === "FunctionDeclaration" && parent.id === p.node) ||
+                    (parent.type === "ClassDeclaration" && parent.id === p.node))) {
+                return;
+            }
+            const binding = p.scope.getBinding(p.node.name);
+            if (binding && taint.bindings.has(binding.path)) {
+                tainted = true;
+                p.stop();
+                return;
+            }
+        }
+        if (p.node.type === "MemberExpression") {
+            const chain = memberChainString(p.node);
+            if (chain && taint.memberChains.has(chain)) {
+                tainted = true;
+                p.stop();
+                return;
+            }
+        }
+    };
+    visit(path);
+    if (!tainted) {
+        path.traverse({
+            enter(p) {
+                visit(p);
+            },
+        });
+    }
+    return tainted;
+};
+/**
+ * Compute the taint info for a chunk AST given the source nodes (URL-derived reads).
+ *
+ * Performs scope-aware iterative propagation:
+ *   - Variable declarators / assignment expressions whose right-hand side
+ *     contains a tainted source node or references a tainted binding/member
+ *     chain are themselves tainted.
+ *   - Tainted bindings are tracked by their declaration NodePath; tainted
+ *     member chains (e.g. `R.current`) are tracked as strings.
+ */
+export const computeTaint = (ast, sourceNodes) => {
+    const taint = {
+        bindings: new Set(),
+        memberChains: new Set(),
+        sourceNodes: new Set(sourceNodes),
+    };
+    // Bound iteration count to avoid pathological cases
+    const maxRounds = 8;
+    for (let round = 0; round < maxRounds; round++) {
+        let changed = false;
+        traverse(ast, {
+            VariableDeclarator(path) {
+                if (!path.node.init)
+                    return;
+                const initPath = path.get("init");
+                if (!expressionIsTainted(initPath, taint))
+                    return;
+                const names = collectIdsFromPattern(path.node.id);
+                for (const name of names) {
+                    const binding = path.scope.getBinding(name);
+                    if (binding && !taint.bindings.has(binding.path)) {
+                        taint.bindings.add(binding.path);
+                        changed = true;
+                    }
+                }
+            },
+            AssignmentExpression(path) {
+                const rightPath = path.get("right");
+                if (!expressionIsTainted(rightPath, taint))
+                    return;
+                const left = path.node.left;
+                if (left.type === "Identifier") {
+                    const binding = path.scope.getBinding(left.name);
+                    if (binding && !taint.bindings.has(binding.path)) {
+                        taint.bindings.add(binding.path);
+                        changed = true;
+                    }
+                }
+                else if (left.type === "MemberExpression") {
+                    const chain = memberChainString(left);
+                    if (chain && !taint.memberChains.has(chain)) {
+                        taint.memberChains.add(chain);
+                        changed = true;
+                    }
+                }
+                else if (left.type === "ObjectPattern" || left.type === "ArrayPattern") {
+                    const names = collectIdsFromPattern(left);
+                    for (const name of names) {
+                        const binding = path.scope.getBinding(name);
+                        if (binding && !taint.bindings.has(binding.path)) {
+                            taint.bindings.add(binding.path);
+                            changed = true;
+                        }
+                    }
+                }
+            },
+            // Propagate taint through callback parameters: when a tainted value is
+            // passed alongside an inline function argument (e.g. watch(tainted, cb)),
+            // the function's parameters may receive the tainted value at call time.
+            CallExpression(path) {
+                const argPaths = path.get("arguments");
+                let hasTaintedNonFunction = false;
+                const inlineFnPaths = [];
+                for (const argPath of argPaths) {
+                    const t_ = argPath.node.type;
+                    if (t_ === "ArrowFunctionExpression" || t_ === "FunctionExpression") {
+                        inlineFnPaths.push(argPath);
+                    }
+                    else if (expressionIsTainted(argPath, taint)) {
+                        hasTaintedNonFunction = true;
+                    }
+                }
+                if (hasTaintedNonFunction) {
+                    for (const fnPath of inlineFnPaths) {
+                        const fnNode = fnPath.node;
+                        for (const param of fnNode.params || []) {
+                            const names = collectIdsFromPattern(param);
+                            for (const name of names) {
+                                const binding = fnPath.scope.getBinding(name);
+                                if (binding && !taint.bindings.has(binding.path)) {
+                                    taint.bindings.add(binding.path);
+                                    changed = true;
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+        });
+        if (!changed)
+            break;
+    }
+    return taint;
+};
+const getSinkValueNodes = (sink) => {
+    switch (sink.type) {
+        case "AssignmentExpression":
+            return [sink.right];
+        case "CallExpression":
+        case "NewExpression": {
+            const args = sink.arguments;
+            return args.filter((a) => a && a.type !== "SpreadElement");
+        }
+        case "ObjectProperty": {
+            const v = sink.value;
+            return v ? [v] : [];
+        }
+        case "JSXAttribute": {
+            // Boolean JSX attributes (e.g. `<div hidden />`) have no value node.
+            const v = sink.value;
+            return v ? [v] : [];
+        }
+        default:
+            return [sink];
+    }
+};
+/**
+ * Returns true when `sinkNode` consumes a value tainted by the URL source(s) used
+ * to compute `taint`. Walks the sink's value-side subtree (RHS for assignments,
+ * arguments for calls/new, value for object/JSX properties) and looks for:
+ *   - direct references to a tainted source subtree,
+ *   - identifiers whose binding is in `taint.bindings`,
+ *   - member-expression chains in `taint.memberChains`.
+ *
+ * To resolve scope-aware bindings, we re-traverse the AST and pick up paths
+ * whose nodes match one of the value-side subtrees.
+ */
+export const sinkConsumesTaint = (ast, sinkNode, taint) => {
+    const valueRoots = new Set(getSinkValueNodes(sinkNode));
+    if (valueRoots.size === 0)
+        return false;
+    let consumed = false;
+    traverse(ast, {
+        enter(path) {
+            if (consumed) {
+                path.stop();
+                return;
+            }
+            if (!valueRoots.has(path.node))
+                return;
+            if (expressionIsTainted(path, taint)) {
+                consumed = true;
+                path.stop();
+            }
+        },
+    });
+    return consumed;
+};
+//# sourceMappingURL=taintFlow.js.map

package/build/analyze/helpers/engineHelpers/taintFlow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taintFlow.js","sourceRoot":"","sources":["../../../../src/analyze/helpers/engineHelpers/taintFlow.ts"],"names":[],"mappings":"AACA,OAAO,SAAgC,MAAM,iBAAiB,CAAC;AAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC;AAQnC,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAiB,EAAE;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,MAAM,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAU,EAAY,EAAE;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO,qBAAqB,CAAC,CAAC,CAAC,KAAa,CAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa;gBAAE,OAAO,qBAAqB,CAAC,CAAC,CAAC,QAAgB,CAAC,CAAC;YAC/E,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAY,CAAC,CAAC;IACvF,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAgB,CAAC,CAAC;IACrF,OAAO,EAAE,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,IAAc,EAAE,KAAgB,EAAW,EAAE;IACtE,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,CAAC,CAAW,EAAE,EAAE;QAC1B,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;YACf,CAAC,CAAC,IAAI,EAAE,CAAC;YACT,OAAO;QACX,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC/B,oEAAoE;YACpE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACxB,IACI,MAAM;gBACN,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;oBACnF,CAAC,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;oBAC/E,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,IAAK,MAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC;oBACvE,CAAC,MAAM,CAAC,IAAI,KAAK,qBAAqB,IAAK,MAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC;oBACxE,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAK,MAAc,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAC5E,CAAC;gBACC,OAAO;YACX,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9C,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,CAAC,IAAI,EAAE,CAAC;gBACT,OAAO;YACX,CAAC;QACL,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,CAAC,IAAI,EAAE,CAAC;gBACT,OAAO;YACX,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC;YACV,KAAK,CAAC,CAAC;gBACH,KAAK,CAAC,CAAC,CAAC,CAAC;YACb,CAAC;SACJ,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAS,EAAE,WAAmB,EAAa,EAAE;IACtE,MAAM,KAAK,GAAc;QACrB,QAAQ,EAAE,IAAI,GAAG,EAAY;QAC7B,YAAY,EAAE,IAAI,GAAG,EAAU;QAC/B,WAAW,EAAE,IAAI,GAAG,CAAO,WAAW,CAAC;KAC1C,CAAC;IAEF,oDAAoD;IACpD,MAAM,SAAS,GAAG,CAAC,CAAC;IACpB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,QAAQ,CAAC,GAAG,EAAE;YACV,kBAAkB,CAAC,IAAI;gBACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,OAAO;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAa,CAAC;gBAC9C,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;oBAAE,OAAO;gBAClD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAU,CAAC,CAAC;gBAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;oBAC5C,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACjC,OAAO,GAAG,IAAI,CAAC;oBACnB,CAAC;gBACL,CAAC;YACL,CAAC;YACD,oBAAoB,CAAC,IAAI;gBACrB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAa,CAAC;gBAChD,IAAI,CAAC,mBAAmB,CAAC,SAAS,EAAE,KAAK,CAAC;oBAAE,OAAO;gBACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAY,CAAC;gBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;wBACjC,OAAO,GAAG,IAAI,CAAC;oBACnB,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;oBACtC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC1C,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBAC9B,OAAO,GAAG,IAAI,CAAC;oBACnB,CAAC;gBACL,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACvE,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;oBAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;wBAC5C,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;4BACjC,OAAO,GAAG,IAAI,CAAC;wBACnB,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YACD,uEAAuE;YACvE,0EAA0E;YAC1E,wEAAwE;YACxE,cAAc,CAAC,IAAI;gBACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,CAAe,CAAC;gBACrD,IAAI,qBAAqB,GAAG,KAAK,CAAC;gBAClC,MAAM,aAAa,GAAe,EAAE,CAAC;gBACrC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;oBAC7B,IAAI,EAAE,KAAK,yBAAyB,IAAI,EAAE,KAAK,oBAAoB,EAAE,CAAC;wBAClE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAChC,CAAC;yBAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;wBAC7C,qBAAqB,GAAG,IAAI,CAAC;oBACjC,CAAC;gBACL,CAAC;gBACD,IAAI,qBAAqB,EAAE,CAAC;oBACxB,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;wBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAW,CAAC;wBAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;4BACtC,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAa,CAAC,CAAC;4BACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gCACvB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gCAC9C,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oCAC/C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oCACjC,OAAO,GAAG,IAAI,CAAC;gCACnB,CAAC;4BACL,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO;YAAE,MAAM;IACxB,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,IAAU,EAAU,EAAE;IAC7C,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,sBAAsB;YACvB,OAAO,CAAC,IAAI,CAAC,KAAa,CAAC,CAAC;QAChC,KAAK,gBAAgB,CAAC;QACtB,KAAK,eAAe,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAI,IAAY,CAAC,SAAmB,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACpB,MAAM,CAAC,GAAI,IAAY,CAAC,KAAgC,CAAC;YACzD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YAClB,qEAAqE;YACrE,MAAM,CAAC,GAAI,IAAY,CAAC,KAAgC,CAAC;YACzD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,CAAC;QACD;YACI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAS,EAAE,QAAc,EAAE,KAAgB,EAAW,EAAE;IACtF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAExC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QACV,KAAK,CAAC,IAAI;YACN,IAAI,QAAQ,EAAE,CAAC;gBACX,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,OAAO;YACX,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO;YACvC,IAAI,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnC,QAAQ,GAAG,IAAI,CAAC;gBAChB,IAAI,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC"}

package/build/analyze/helpers/initRules.js

@@ -0,0 +1,111 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import extract from "extract-zip";
+/**
+ * Downloads and extracts the latest analysis rules from the GitHub repository.
+ *
+ * Fetches the latest release from the js-recon-rules repository, downloads the zipball,
+ * extracts it to the user's home directory, and performs cleanup operations.
+ *
+ * @param homeDir - The user's home directory path
+ * @returns Promise that resolves when rules are downloaded and extracted
+ */
+const downloadRules = (homeDir) => __awaiter(void 0, void 0, void 0, function* () {
+    console.log(chalk.cyan("[i] Rules not found. Downloading from GitHub..."));
+    const response = yield fetch("https://api.github.com/repos/shriyanss/js-recon-rules/releases/latest");
+    const release = yield response.json();
+    const zipballUrl = release.zipball_url;
+    const zipPath = path.join(homeDir, "/.js-recon/rules.zip");
+    const downloadResponse = yield fetch(zipballUrl);
+    if (!downloadResponse.ok) {
+        throw new Error(`Failed to download rules: ${downloadResponse.statusText}`);
+    }
+    const arrayBuffer = yield downloadResponse.arrayBuffer();
+    const buffer = Buffer.from(arrayBuffer);
+    fs.writeFileSync(zipPath, buffer);
+    console.log(chalk.cyan("[i] Unzipping rules..."));
+    const extractPath = path.join(homeDir, "/.js-recon");
+    yield extract(zipPath, { dir: extractPath });
+    // Find the extracted directory
+    const files = fs.readdirSync(extractPath);
+    const extractedDir = files.find((file) => fs.statSync(path.join(extractPath, file)).isDirectory() && file.startsWith("shriyanss-js-recon-rules-"));
+    if (extractedDir) {
+        fs.renameSync(path.join(extractPath, extractedDir), path.join(extractPath, "rules"));
+    }
+    else {
+        throw new Error("Could not find extracted rules directory.");
+    }
+    fs.unlinkSync(zipPath); // Clean up the zip file
+    // remove the directory .js-recon/rules/.github
+    fs.rmSync(path.join(homeDir, "/.js-recon/rules/.github"), { recursive: true });
+    // If the release ships a skills/ directory, stage it at ~/.js-recon/skills/.
+    const rulesSkillsDir = path.join(homeDir, "/.js-recon/rules/skills");
+    const skillsDir = path.join(homeDir, "/.js-recon/skills");
+    if (fs.existsSync(rulesSkillsDir)) {
+        if (fs.existsSync(skillsDir)) {
+            fs.rmSync(skillsDir, { recursive: true });
+        }
+        fs.renameSync(rulesSkillsDir, skillsDir);
+    }
+    console.log(chalk.green("[✓] Rules initialized successfully."));
+});
+/**
+ * Initializes the analysis rules system by ensuring rules are available and up-to-date.
+ *
+ * This function:
+ * 1. Creates the .js-recon directory if it doesn't exist
+ * 2. Downloads rules if they're missing
+ * 3. Validates rule integrity
+ * 4. Checks for and downloads rule updates from GitHub
+ *
+ * @returns Promise that resolves when rules initialization is complete
+ */
+const initRules = () => __awaiter(void 0, void 0, void 0, function* () {
+    console.log(chalk.cyan("[i] Initializing rules..."));
+    // get the user's home dir
+    const homeDir = process.env.HOME;
+    // check if the .js-recon directory exists
+    if (!fs.existsSync(path.join(homeDir, "/.js-recon"))) {
+        fs.mkdirSync(path.join(homeDir, "/.js-recon"));
+    }
+    // now, check if the rules directory exists
+    if (!fs.existsSync(path.join(homeDir, "/.js-recon/rules"))) {
+        yield downloadRules(homeDir);
+    }
+    // now that this rule exists, check if the version.txt exists
+    const versionPath = path.join(homeDir, "/.js-recon/rules/version.txt");
+    if (!fs.existsSync(versionPath)) {
+        console.error(chalk.yellow("[!] Rules directory is corrupted. Downloading again..."));
+        // remove the rules directory
+        fs.rmSync(path.join(homeDir, "/.js-recon/rules"), { recursive: true });
+        yield downloadRules(homeDir);
+    }
+    // also, if the version.txt exist, check if the version.txt is latest as per the latest release on github
+    const version = fs.readFileSync(versionPath, "utf8").trim();
+    try {
+        const response = yield fetch("https://api.github.com/repos/shriyanss/js-recon-rules/releases/latest");
+        const release = yield response.json();
+        const release_tag_name = release.tag_name;
+        if (`v${version}` !== release_tag_name) {
+            console.error(chalk.yellow("[!] Rules are not up to date. Downloading latest version..."));
+            // remove the rules directory
+            fs.rmSync(path.join(homeDir, "/.js-recon/rules"), { recursive: true });
+            yield downloadRules(homeDir);
+        }
+    }
+    catch (_a) {
+        console.error(chalk.red("[!] An error occured when fetching rules from GitHub"));
+    }
+});
+export default initRules;
+//# sourceMappingURL=initRules.js.map

package/build/analyze/helpers/initRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"initRules.js","sourceRoot":"","sources":["../../../src/analyze/helpers/initRules.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,aAAa,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,CAAO,OAAe,EAAiB,EAAE;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uEAAuE,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAE7C,+BAA+B;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CACL,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,2BAA2B,CAAC,CAC9G,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACf,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;IAChD,+CAA+C;IAC/C,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;AACpE,CAAC,CAAA,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAG,GAAwB,EAAE;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAErD,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAEjC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtF,6BAA6B;QAC7B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,yGAAyG;IACzG,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACtG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC1C,IAAI,IAAI,OAAO,EAAE,KAAK,gBAAgB,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAC;YAC3F,6BAA6B;YAC7B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;IACrF,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,eAAe,SAAS,CAAC"}

package/build/analyze/helpers/outputHelper.js

@@ -0,0 +1,14 @@
+import fs from "fs";
+import chalk from "chalk";
+/**
+ * Writes analysis findings to a JSON file.
+ *
+ * @param {string} outputFile - Path to the output file where findings will be written
+ * @param {EngineOutput[]} findings - Array of analysis findings to write to the output file
+ */
+export const generateEngineOutput = (outputFile, findings) => {
+    console.log(chalk.cyan("[i] Generating engine output..."));
+    fs.writeFileSync(outputFile, JSON.stringify(findings, null, 2));
+    console.log(chalk.green("[✓] Engine output generated successfully."));
+};
+//# sourceMappingURL=outputHelper.js.map

package/build/analyze/helpers/outputHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outputHelper.js","sourceRoot":"","sources":["../../../src/analyze/helpers/outputHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAc1B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAkB,EAAE,QAAwB,EAAE,EAAE;IACjF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;IAC3D,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC,CAAC;AAC1E,CAAC,CAAC"}

package/build/analyze/helpers/schemas.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+const requestStepSchema = z.union([
+    z.object({
+        type: z.literal("headers"),
+        condition: z.enum(["contains", "absent"]),
+        name: z.string(),
+    }),
+    z.object({
+        type: z.literal("url"),
+        condition: z.enum(["contains", "absent"]),
+        name: z.string(),
+    }),
+    z.object({
+        type: z.literal("method"),
+        condition: z.enum(["is", "is_not"]),
+        name: z.string(),
+    }),
+]);
+const esqueryStepSchema = z.object({
+    type: z.literal("esquery"),
+    query: z.string(),
+    inScopeOf: z.string().optional(),
+    taintFrom: z.string().optional(),
+});
+const PostMessageFuncResolverStepSchema = z.object({
+    name: z.string(),
+});
+const checkAssignmentExistStepSchema = z.object({
+    name: z.string(),
+    type: z.string(),
+    memberExpression: z.boolean().optional(),
+});
+const regexMatchStepSchema = z.object({
+    pattern: z.string(),
+});
+const stepSchema = z.object({
+    name: z.string(),
+    message: z.string(),
+    requires: z.array(z.string()).optional(),
+    request: requestStepSchema.optional(),
+    esquery: esqueryStepSchema.optional(),
+    postMessageFuncResolve: PostMessageFuncResolverStepSchema.optional(),
+    checkAssignmentExist: checkAssignmentExistStepSchema.optional(),
+    regexMatch: regexMatchStepSchema.optional(),
+});
+export const ruleSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    author: z.string(),
+    description: z.string(),
+    js_recon_version: z.string(),
+    tech: z.array(z.enum(["next", "vue", "react", "svelte", "all"])),
+    severity: z.enum(["info", "low", "medium", "high"]),
+    type: z.enum(["request", "ast"]),
+    steps: z.array(stepSchema),
+});
+//# sourceMappingURL=schemas.js.map

package/build/analyze/helpers/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/analyze/helpers/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9B,CAAC,CAAC,MAAM,CAAC;QACL,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACL,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACL,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACnB,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACrC,sBAAsB,EAAE,iCAAiC,CAAC,QAAQ,EAAE;IACpE,oBAAoB,EAAE,8BAA8B,CAAC,QAAQ,EAAE;IAC/D,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;CAC7B,CAAC,CAAC"}

package/build/analyze/helpers/validate.js

@@ -0,0 +1,89 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import chalk from "chalk";
+import fs from "fs";
+import yaml from "yaml";
+import { ruleSchema } from "./schemas.js";
+import CONFIG from "../../globalConfig.js";
+const parseVersion = (version) => {
+    const clean = version.split("-")[0];
+    const parts = clean.split(".").map(Number);
+    return [parts[0] || 0, parts[1] || 0, parts[2] || 0];
+};
+const compareVersions = (a, b) => {
+    for (let i = 0; i < 3; i++) {
+        if (a[i] !== b[i])
+            return a[i] - b[i];
+    }
+    return 0;
+};
+const isVersionCompatible = (requirement, currentVersion) => {
+    const match = requirement.match(/^(>=|<=|>|<|==?)\s*(.+)/);
+    if (!match)
+        return false; // Invalid format
+    const [, op, reqVer] = match;
+    const current = parseVersion(currentVersion);
+    const required = parseVersion(reqVer);
+    const cmp = compareVersions(current, required);
+    switch (op) {
+        case ">=":
+            return cmp >= 0;
+        case "<=":
+            return cmp <= 0;
+        case ">":
+            return cmp > 0;
+        case "<":
+            return cmp < 0;
+        case "=":
+        case "==":
+            return cmp === 0;
+        default:
+            return true;
+    }
+};
+/**
+ * Validates a collection of YAML rule files against the defined schema and version requirements.
+ *
+ * Reads each rule file, parses the YAML content, validates it against the rule schema,
+ * and checks whether the rule's declared js_recon_version is satisfied by the current version.
+ * Rules that require a higher js-recon version are skipped with a warning.
+ *
+ * @param ruleFiles - Array of file paths to YAML rule files to validate
+ * @returns Promise that resolves to an object with allValid (schema validity) and compatibleRuleFiles (version-compatible files)
+ */
+const validateRules = (ruleFiles) => __awaiter(void 0, void 0, void 0, function* () {
+    console.log(chalk.cyan("[i] Validating rules..."));
+    let allValid = true;
+    const compatibleRuleFiles = [];
+    for (const ruleFile of ruleFiles) {
+        try {
+            const ruleData = fs.readFileSync(ruleFile, "utf8");
+            const rule = yaml.parse(ruleData);
+            ruleSchema.parse(rule);
+            if (!isVersionCompatible(rule.js_recon_version, CONFIG.version)) {
+                console.error(chalk.yellow(`[!] Skipping ${ruleFile}: requires js-recon ${rule.js_recon_version} (current: ${CONFIG.version})`));
+                continue;
+            }
+            compatibleRuleFiles.push(ruleFile);
+        }
+        catch (error) {
+            allValid = false;
+            console.error(chalk.red(`[!] Invalid rule in ${ruleFile}:`));
+            if (error.errors) {
+                for (const err of error.errors) {
+                    console.error(chalk.red(`  - ${err.path.join(".")} - ${err.message}`));
+                }
+            }
+        }
+    }
+    return { allValid, compatibleRuleFiles };
+});
+export default validateRules;
+//# sourceMappingURL=validate.js.map

package/build/analyze/helpers/validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/analyze/helpers/validate.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,MAAM,MAAM,uBAAuB,CAAC;AAE3C,MAAM,YAAY,GAAG,CAAC,OAAe,EAA4B,EAAE;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,CAA2B,EAAE,CAA2B,EAAU,EAAE;IACzF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAE,cAAsB,EAAW,EAAE;IACjF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC,CAAC,iBAAiB;IAC3C,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,QAAQ,EAAE,EAAE,CAAC;QACT,KAAK,IAAI;YACL,OAAO,GAAG,IAAI,CAAC,CAAC;QACpB,KAAK,IAAI;YACL,OAAO,GAAG,IAAI,CAAC,CAAC;QACpB,KAAK,GAAG;YACJ,OAAO,GAAG,GAAG,CAAC,CAAC;QACnB,KAAK,GAAG;YACJ,OAAO,GAAG,GAAG,CAAC,CAAC;QACnB,KAAK,GAAG,CAAC;QACT,KAAK,IAAI;YACL,OAAO,GAAG,KAAK,CAAC,CAAC;QACrB;YACI,OAAO,IAAI,CAAC;IACpB,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,aAAa,GAAG,CAAO,SAAmB,EAAiE,EAAE;IAC/G,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ,GAAG,IAAI,CAAC;IACpB,MAAM,mBAAmB,GAAa,EAAE,CAAC;IAEzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAClC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEvB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,KAAK,CACT,KAAK,CAAC,MAAM,CACR,gBAAgB,QAAQ,uBAAuB,IAAI,CAAC,gBAAgB,cAAc,MAAM,CAAC,OAAO,GAAG,CACtG,CACJ,CAAC;gBACF,SAAS;YACb,CAAC;YAED,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,QAAQ,GAAG,KAAK,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,QAAQ,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAC7B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC3E,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC;AAC7C,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}