@js-recon/js-recon 1.4.1-alpha.9 → 1.4.1-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/build-and-prettify.yaml +2 -0
- package/.github/workflows/promote-js-recon.yml +178 -0
- package/CHANGELOG.md +18 -0
- package/CLAUDE.md +16 -4
- package/README.md +3 -1
- package/build/analyze/helpers/initRules.js +1 -1
- package/build/analyze/helpers/initRules.js.map +1 -1
- package/build/globalConfig.js +1 -1
- package/build/globalConfig.js.map +1 -1
- package/package.json +1 -1
- package/.claude/settings.local.json +0 -10
- package/urls.txt +0 -5
|
@@ -102,3 +102,181 @@ jobs:
|
|
|
102
102
|
|
|
103
103
|
env:
|
|
104
104
|
VERSION: ${{ inputs.version }}
|
|
105
|
+
|
|
106
|
+
verify-npm-install:
|
|
107
|
+
runs-on: ubuntu-latest
|
|
108
|
+
permissions:
|
|
109
|
+
contents: read
|
|
110
|
+
steps:
|
|
111
|
+
- name: Checkout js-recon-labs
|
|
112
|
+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
113
|
+
with:
|
|
114
|
+
repository: js-recon/js-recon-labs
|
|
115
|
+
path: js-recon-labs
|
|
116
|
+
persist-credentials: false
|
|
117
|
+
|
|
118
|
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
119
|
+
with:
|
|
120
|
+
node-version: "22"
|
|
121
|
+
|
|
122
|
+
- name: Install js-recon globally from npm
|
|
123
|
+
run: npm install -g "@js-recon/js-recon@${VERSION}"
|
|
124
|
+
env:
|
|
125
|
+
VERSION: ${{ inputs.version }}
|
|
126
|
+
|
|
127
|
+
- name: Verify installed version
|
|
128
|
+
run: |
|
|
129
|
+
INSTALLED=$(js-recon -V)
|
|
130
|
+
echo "Installed: ${INSTALLED}"
|
|
131
|
+
[[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch"; exit 1; }
|
|
132
|
+
env:
|
|
133
|
+
VERSION: ${{ inputs.version }}
|
|
134
|
+
|
|
135
|
+
- name: Install and start vulnerable app
|
|
136
|
+
working-directory: js-recon-labs/next_js/vuln-all-rules
|
|
137
|
+
run: |
|
|
138
|
+
npm ci
|
|
139
|
+
npm run build
|
|
140
|
+
npm start &
|
|
141
|
+
|
|
142
|
+
- name: Wait for app to be ready
|
|
143
|
+
run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
|
|
144
|
+
|
|
145
|
+
- name: Run installed js-recon against the lab app
|
|
146
|
+
run: |
|
|
147
|
+
echo "http://localhost:3001" > /tmp/npm-smoke-urls.txt
|
|
148
|
+
js-recon run -u /tmp/npm-smoke-urls.txt --no-sandbox -y -k
|
|
149
|
+
env:
|
|
150
|
+
PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome-stable
|
|
151
|
+
|
|
152
|
+
- name: Verify expected output files exist
|
|
153
|
+
run: |
|
|
154
|
+
test -n "$(find output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
|
|
155
|
+
test -n "$(find output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
|
|
156
|
+
|
|
157
|
+
verify-docker-install:
|
|
158
|
+
runs-on: ubuntu-latest
|
|
159
|
+
needs: publish-ghcr
|
|
160
|
+
permissions:
|
|
161
|
+
contents: read
|
|
162
|
+
packages: read
|
|
163
|
+
steps:
|
|
164
|
+
- name: Checkout js-recon-labs
|
|
165
|
+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
166
|
+
with:
|
|
167
|
+
repository: js-recon/js-recon-labs
|
|
168
|
+
path: js-recon-labs
|
|
169
|
+
persist-credentials: false
|
|
170
|
+
|
|
171
|
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
172
|
+
with:
|
|
173
|
+
node-version: "22"
|
|
174
|
+
|
|
175
|
+
- uses: docker/login-action@v3
|
|
176
|
+
with:
|
|
177
|
+
registry: ghcr.io
|
|
178
|
+
username: ${{ github.actor }}
|
|
179
|
+
password: ${{ secrets.GITHUB_TOKEN }}
|
|
180
|
+
|
|
181
|
+
- name: Verify installed version
|
|
182
|
+
run: |
|
|
183
|
+
INSTALLED=$(docker run --rm ghcr.io/js-recon/js-recon:${VERSION} -V)
|
|
184
|
+
echo "Installed: ${INSTALLED}"
|
|
185
|
+
[[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch"; exit 1; }
|
|
186
|
+
env:
|
|
187
|
+
VERSION: ${{ inputs.version }}
|
|
188
|
+
|
|
189
|
+
- name: Install and start vulnerable app
|
|
190
|
+
working-directory: js-recon-labs/next_js/vuln-all-rules
|
|
191
|
+
run: |
|
|
192
|
+
npm ci
|
|
193
|
+
npm run build
|
|
194
|
+
npm start &
|
|
195
|
+
|
|
196
|
+
- name: Wait for app to be ready
|
|
197
|
+
run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
|
|
198
|
+
|
|
199
|
+
- name: Run containerized js-recon against the lab app
|
|
200
|
+
run: |
|
|
201
|
+
mkdir -p /tmp/docker-output
|
|
202
|
+
echo "http://localhost:3001" > /tmp/docker-smoke-urls.txt
|
|
203
|
+
docker run --rm --network host \
|
|
204
|
+
-v /tmp/docker-output:/app/output \
|
|
205
|
+
-v /tmp/docker-smoke-urls.txt:/app/urls.txt \
|
|
206
|
+
ghcr.io/js-recon/js-recon:${VERSION} \
|
|
207
|
+
run -u /app/urls.txt --no-sandbox -y -k
|
|
208
|
+
env:
|
|
209
|
+
VERSION: ${{ inputs.version }}
|
|
210
|
+
|
|
211
|
+
- name: Verify expected output files exist
|
|
212
|
+
run: |
|
|
213
|
+
test -n "$(find /tmp/docker-output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
|
|
214
|
+
test -n "$(find /tmp/docker-output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
|
|
215
|
+
|
|
216
|
+
verify-brew-install:
|
|
217
|
+
runs-on: macos-latest
|
|
218
|
+
needs: update-homebrew-tap
|
|
219
|
+
permissions:
|
|
220
|
+
contents: read
|
|
221
|
+
strategy:
|
|
222
|
+
fail-fast: false
|
|
223
|
+
matrix:
|
|
224
|
+
formula: [js-recon, js-recon-alpha, js-recon-beta]
|
|
225
|
+
steps:
|
|
226
|
+
- name: Checkout js-recon-labs
|
|
227
|
+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
228
|
+
with:
|
|
229
|
+
repository: js-recon/js-recon-labs
|
|
230
|
+
path: js-recon-labs
|
|
231
|
+
persist-credentials: false
|
|
232
|
+
|
|
233
|
+
- name: Tap and install
|
|
234
|
+
run: |
|
|
235
|
+
brew tap js-recon/tap
|
|
236
|
+
brew update
|
|
237
|
+
brew install "js-recon/tap/${{ matrix.formula }}"
|
|
238
|
+
|
|
239
|
+
- name: Determine expected formula for this version
|
|
240
|
+
id: expected
|
|
241
|
+
run: |
|
|
242
|
+
if [[ "$VERSION" == *"alpha"* ]]; then
|
|
243
|
+
echo "formula=js-recon-alpha" >> "$GITHUB_OUTPUT"
|
|
244
|
+
elif [[ "$VERSION" == *"beta"* ]]; then
|
|
245
|
+
echo "formula=js-recon-beta" >> "$GITHUB_OUTPUT"
|
|
246
|
+
else
|
|
247
|
+
echo "formula=js-recon" >> "$GITHUB_OUTPUT"
|
|
248
|
+
fi
|
|
249
|
+
env:
|
|
250
|
+
VERSION: ${{ inputs.version }}
|
|
251
|
+
|
|
252
|
+
- name: Verify installed version
|
|
253
|
+
run: |
|
|
254
|
+
INSTALLED=$(js-recon -V)
|
|
255
|
+
echo "Installed: ${INSTALLED}"
|
|
256
|
+
if [[ "${{ matrix.formula }}" == "${{ steps.expected.outputs.formula }}" ]]; then
|
|
257
|
+
[[ "$INSTALLED" == *"$VERSION"* ]] || { echo "Version mismatch: expected ${VERSION} in ${{ matrix.formula }}"; exit 1; }
|
|
258
|
+
else
|
|
259
|
+
echo "Skipping version assertion — ${{ matrix.formula }} is not the channel updated by this promotion"
|
|
260
|
+
fi
|
|
261
|
+
env:
|
|
262
|
+
VERSION: ${{ inputs.version }}
|
|
263
|
+
|
|
264
|
+
- name: Install and start vulnerable app
|
|
265
|
+
working-directory: js-recon-labs/next_js/vuln-all-rules
|
|
266
|
+
run: |
|
|
267
|
+
npm ci
|
|
268
|
+
npm run build
|
|
269
|
+
npm start &
|
|
270
|
+
|
|
271
|
+
- name: Wait for app to be ready
|
|
272
|
+
run: timeout 60 bash -c 'until curl -sf http://localhost:3001 > /dev/null; do sleep 2; done'
|
|
273
|
+
|
|
274
|
+
- name: Run installed js-recon against the lab app
|
|
275
|
+
run: |
|
|
276
|
+
echo "http://localhost:3001" > /tmp/brew-smoke-urls.txt
|
|
277
|
+
js-recon run -u /tmp/brew-smoke-urls.txt -y -k
|
|
278
|
+
|
|
279
|
+
- name: Verify expected output files exist
|
|
280
|
+
run: |
|
|
281
|
+
test -n "$(find output -name analyze.json)" || { echo "analyze.json missing"; exit 1; }
|
|
282
|
+
test -n "$(find output -name js-recon.db)" || { echo "js-recon.db missing"; exit 1; }
|
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,17 @@
|
|
|
1
1
|
# Change Log
|
|
2
2
|
|
|
3
|
+
## 1.4.1-beta.1 - 2026-07-16
|
|
4
|
+
|
|
5
|
+
### Fixed
|
|
6
|
+
|
|
7
|
+
- Homebrew: documented the fix for `Formulae found in multiple taps` / `Refusing to load formula ... from untrusted tap ...` errors hit by users who still have the old `shriyanss/tap` tapped from before the `js-recon` org migration. `js-recon/homebrew-tap` was created by renaming `shriyanss/homebrew-tap`, so GitHub still transparently resolves the old tap name to the same repo content — leaving two tap names serving an identically-named `js-recon` formula. Run `brew untap shriyanss/tap` before installing from `js-recon/tap` (see README.md and the Homebrew installation docs). (`docs`, `homebrew`)
|
|
8
|
+
|
|
9
|
+
## 1.4.1-alpha.10 - 2026-07-15
|
|
10
|
+
|
|
11
|
+
### Changed
|
|
12
|
+
|
|
13
|
+
- The project has moved to the `js-recon` GitHub organization. The npm package is now published as **`@js-recon/js-recon`** (previously `@shriyanss/js-recon`) — update your install commands accordingly. Container images are now published only to `ghcr.io/js-recon/js-recon` (Docker Hub publishing has been discontinued). The Homebrew tap is now `js-recon/tap` (`brew tap js-recon/tap`), and the Terraform modules are published under the `js-recon/js-recon/<cloud>` registry namespace. (`all`, `ci`, `docker`, `homebrew`)
|
|
14
|
+
|
|
3
15
|
## 1.4.1-alpha.9 - 2026-07-15
|
|
4
16
|
|
|
5
17
|
### Fixed
|
|
@@ -162,6 +174,12 @@
|
|
|
162
174
|
- `refactor -t react` renamed to `refactor -t react-webpack` to make the bundler explicit
|
|
163
175
|
- Improved tool description in `globalConfig.ts`
|
|
164
176
|
|
|
177
|
+
## 1.3.2 - 2026-07-15
|
|
178
|
+
|
|
179
|
+
### Fixed
|
|
180
|
+
|
|
181
|
+
- Rules auto-download now works under the `js-recon` GitHub organization. Backported stable hotfix (functionally identical to 1.3.1), released so `@js-recon/js-recon` has a working stable `latest` after the org migration: `initRules` fetches from `js-recon/js-recon-rules` and matches the `js-recon-js-recon-rules-` release-archive prefix (previously `shriyanss`), which otherwise broke `js-recon run`'s rule download. Shipped from the `hotfix/1.3.2` branch and is intentionally not part of the `1.4.1-alpha` line on `dev`/`main`. (`analyze`)
|
|
182
|
+
|
|
165
183
|
## 1.3.1-beta.1 - 2026-06-08
|
|
166
184
|
|
|
167
185
|
### Added
|
package/CLAUDE.md
CHANGED
|
@@ -389,8 +389,8 @@ Before writing any files, gather the current state:
|
|
|
389
389
|
|
|
390
390
|
6. **Open PR** using `gh pr create`:
|
|
391
391
|
|
|
392
|
-
| Repo
|
|
393
|
-
|
|
|
392
|
+
| Repo | Source | Target | Title | Body |
|
|
393
|
+
| ------------------- | ------ | ------ | ------------------------------------------- | ------------------------------------ |
|
|
394
394
|
| `js-recon/js-recon` | `dev` | `main` | bare version string (e.g. `v1.3.1-alpha.4`) | raw `## <version>` changelog section |
|
|
395
395
|
|
|
396
396
|
7. **Monitor js-recon CI** — use `gh pr checks <pr-number> --repo js-recon/js-recon` and poll until all checks complete. Handle CodeRabbit suggestions (see below). Do NOT merge — wait for user approval.
|
|
@@ -414,7 +414,6 @@ Before writing any files, gather the current state:
|
|
|
414
414
|
9. **Wait for npm stage publish** — monitor the release pipeline: `gh run list --repo js-recon/js-recon --workflow "Publish JS Recon"`. `publish-npm` uses OIDC trusted publishing (`npm stage publish`, no token) to _stage_ the release — this is NOT the same as it being live.
|
|
415
415
|
|
|
416
416
|
10. **Approve the staged release** — npm's staged-publish approval always requires interactive 2FA, so this step can never be automated or scripted:
|
|
417
|
-
|
|
418
417
|
- Find the stage id: `npm stage list @js-recon/js-recon` (or the "Staged Packages" tab on npmjs.com)
|
|
419
418
|
- Approve it: `npm stage approve <stage-id>` (prompts for 2FA), or click "Approve" on npmjs.com
|
|
420
419
|
- Confirm it's live: `npm view @js-recon/js-recon@<version>`
|
|
@@ -448,6 +447,8 @@ Monitor: `gh run list --repo js-recon/homebrew-tap --workflow ci.yml`
|
|
|
448
447
|
- `js-recon/homebrew-tap` is a public GitHub repo with formulas at `Formula/js-recon.rb` (stable), `Formula/js-recon-alpha.rb`, and `Formula/js-recon-beta.rb`
|
|
449
448
|
- `HOMEBREW_TAP_GH_PAT` is a fine-grained PAT stored in `js-recon/js-recon` → Settings → Environments → `homebrew-publish` → Environment secrets, scoped exclusively to the `homebrew-tap` repo
|
|
450
449
|
|
|
450
|
+
**Known migration gotcha (`shriyanss/tap` → `js-recon/tap`):** `js-recon/homebrew-tap` was created by **renaming** the original `shriyanss/homebrew-tap` repo, not by creating a fresh one. GitHub transparently redirects git operations on the old `shriyanss/homebrew-tap` URL to the same repo, so anyone who still has `shriyanss/tap` tapped locally ends up with two tap names serving an identically-named `js-recon` formula. This trips Homebrew's cross-tap ambiguity/trust guard (`Formulae found in multiple taps` on a bare `brew install js-recon`, or `Refusing to load formula ... from untrusted tap ...`). Since it's the same underlying repo, there's no way to make the old tap name behave differently — the only fix is instructing affected users to run `brew untap shriyanss/tap` before installing from `js-recon/tap` (documented in `README.md` and `js-recon-docs/docs/docs/installation.md`).
|
|
451
|
+
|
|
451
452
|
### Docker / GHCR images (manual, part of `promote-js-recon.yml`)
|
|
452
453
|
|
|
453
454
|
`publish-docker` and `publish-ghcr` (now in `promote-js-recon.yml`) build from `Dockerfile.release` instead of the default `Dockerfile`. `Dockerfile.release` runs `npm install -g @js-recon/js-recon@<version>` against the live registry rather than copying local source and building — the published images are provably built from the approved npm artifact. The default `Dockerfile` (source build) is unchanged and still used for local/dev builds.
|
|
@@ -480,6 +481,17 @@ Monitor: `gh run list --repo js-recon/homebrew-tap --workflow ci.yml`
|
|
|
480
481
|
|
|
481
482
|
14. **Monitor docs CI** — `version_check` should pass now that the npm package is live. CodeRabbit rate-limit comments are non-blocking.
|
|
482
483
|
|
|
484
|
+
### Post-release branching model
|
|
485
|
+
|
|
486
|
+
Once a release's GitHub release is created, `main` and `dev` become identical after the `merge_main_and_dev` job in `publish-js-recon.yml` finishes — confirm that job completed successfully (`gh run list --repo js-recon/js-recon --workflow "Publish JS Recon"`) before cutting `post-<stable_version>` off either branch.
|
|
487
|
+
|
|
488
|
+
- While a version is running through its alpha/beta channels at scale (i.e. before the matching stable release ships), `dev` is reserved for **fixes to that version only** — bugs found while the beta is being validated. Do not land new features on `dev` during this window.
|
|
489
|
+
- New feature development for the _next_ version happens on a `post-<stable_version>` branch (e.g. `post-1.4.1`), cut from `dev`/`main` right after the current version's first release. This branch is where unrelated feature work accumulates while `dev` stays focused on stabilizing the in-flight release.
|
|
490
|
+
- When the current version is promoted to stable (green flag from the user to go from `<version>-beta.*` to `<version>`), release it the normal way, then merge `post-<stable_version>` into `dev` via a PR — same as any other merge, this requires CI green and explicit user approval before merging (see "Stop before merge" below). The `post-<stable_version>` branch itself is **retained** (not deleted) until the user manually removes it — it is a historical record of what shipped in the next release.
|
|
491
|
+
- Bump the tool's version on the new `post-<stable_version>` branch immediately after cutting it, so `dev` commits during the stabilization window keep targeting the version actually being stabilized.
|
|
492
|
+
|
|
493
|
+
This policy is also documented in `js-recon-internal-docs` under the Maintenance section — see that for the full rationale.
|
|
494
|
+
|
|
483
495
|
### Handling CodeRabbit
|
|
484
496
|
|
|
485
497
|
After any PR is created, poll for review comments:
|
|
@@ -569,7 +581,7 @@ The `refactor` command supports the following techs:
|
|
|
569
581
|
- **`react-vite`** — Vite (rolldown) React bundles. Removes CJS interop wrappers, rewrites vendor imports to canonical library imports (`react`, `react/jsx-runtime`, etc.), recovers JSX. Runs a Vite build check after writing output. See `src/refactor/react-vite/CLAUDE.md`.
|
|
570
582
|
- **`next`** — Next.js bundles (legacy).
|
|
571
583
|
- **`next-turbopack`** — Next.js Turbopack chunks. Handles both turbopack 3-param `func_NNN=(runtime,module,exports)=>{}` and 1-param `func_NNN=(runtime)=>{}` formats plus webpack-style coexisting chunks. See `src/refactor/next/CLAUDE.md`.
|
|
572
|
-
- **`next-webpack`** — Next.js webpack chunks. Input format from `mapped.json`: `NNN:(module,exports,require)=>{}` (arrow form) or `function webpack_NNN(module,exports,require){}` (named-function form — the dominant form on real-world bundles; see `src/refactor/next/CLAUDE.md`). Recovers named exports (ODP, require.d), default exports (module.exports=V), re-exports (module.exports=require(N)→export
|
|
584
|
+
- **`next-webpack`** — Next.js webpack chunks. Input format from `mapped.json`: `NNN:(module,exports,require)=>{}` (arrow form) or `function webpack_NNN(module,exports,require){}` (named-function form — the dominant form on real-world bundles; see `src/refactor/next/CLAUDE.md`). Recovers named exports (ODP, require.d), default exports (module.exports=V), re-exports (module.exports=require(N)→export\*), and require hoisting. Param order: params[0]=module, params[1]=exports, params[2]=require. Recovery-rate benchmark: see `docs/js-recon-core/bug-reports/nextjs-webpack-refactor-function-wrapper-miss.md` in js-recon-internal-docs for the corrected baseline (the previous "277/280 modules recovered" figure only exercised the arrow-form wrapper and was not representative of real-world bundles).
|
|
573
585
|
- **`vue-webpack`** — Vue.js webpack 4/5 chunks. Container format: `(window.webpackJsonp||[]).push([[chunkIds],{moduleId:function(t,e,r){...}}])`. Each chunk file may contain multiple module functions; each is extracted and transformed. Reuses the Next.js webpack transform (same module param semantics: params[0]=module, params[1]=exports, params[2]=require). See `src/refactor/vue/index.ts`.
|
|
574
586
|
- **`vue-vite`** — Vue 3 + Vite page chunks. The main index chunk (contains `__vccOpts`, all of Vue runtime) is analysed to build an export-alias→canonical-name map. Lazy page chunks then have their index imports rewritten to canonical `import {...} from 'vue'` statements. The `_export_sfc` compiler helper is inlined as a local const. See `src/refactor/vue/vite.ts` and `src/refactor/vue/vendor-analyze-vue.ts`.
|
|
575
587
|
|
package/README.md
CHANGED
|
@@ -34,6 +34,8 @@ To update:
|
|
|
34
34
|
brew update && brew upgrade js-recon
|
|
35
35
|
```
|
|
36
36
|
|
|
37
|
+
> **Note:** If you installed JS Recon before the move to the `js-recon` GitHub organization, you may still have the old `shriyanss/tap` tapped locally. Since that repo was renamed (not deleted), Homebrew still resolves it, leaving two taps that both serve a formula named `js-recon` — causing errors like `Formulae found in multiple taps` or `Refusing to load formula ... from untrusted tap ...`. Fix with `brew untap shriyanss/tap` before installing from `js-recon/tap`.
|
|
38
|
+
>
|
|
37
39
|
> **Note:** After installing via Homebrew, the `lazyload` subcommand requires a Chromium browser. Run `brew info js-recon` for setup instructions.
|
|
38
40
|
|
|
39
41
|
### npm (all platforms)
|
|
@@ -119,7 +121,7 @@ For detailed guides, command options, and advanced usage examples, please check
|
|
|
119
121
|
<img src="https://github.com/js-recon/js-recon-labs/blob/main/static/labs-banner.png?raw=true" alt="JS Recon Labs" width="300"/>
|
|
120
122
|
</p>
|
|
121
123
|
|
|
122
|
-
Labs to test JS Recon tool are available [
|
|
124
|
+
Labs to test JS Recon tool are available in the [JS Recon Labs repository](https://github.com/js-recon/js-recon-labs). [Labs walkthroughs](https://js-recon.io/labs) are also available.
|
|
123
125
|
|
|
124
126
|
## Contributing
|
|
125
127
|
|
|
@@ -38,7 +38,7 @@ const downloadRules = (homeDir) => __awaiter(void 0, void 0, void 0, function* (
|
|
|
38
38
|
yield extract(zipPath, { dir: extractPath });
|
|
39
39
|
// Find the extracted directory
|
|
40
40
|
const files = fs.readdirSync(extractPath);
|
|
41
|
-
const extractedDir = files.find((file) => fs.statSync(path.join(extractPath, file)).isDirectory() && file.startsWith("
|
|
41
|
+
const extractedDir = files.find((file) => fs.statSync(path.join(extractPath, file)).isDirectory() && file.startsWith("js-recon-js-recon-rules-"));
|
|
42
42
|
if (extractedDir) {
|
|
43
43
|
fs.renameSync(path.join(extractPath, extractedDir), path.join(extractPath, "rules"));
|
|
44
44
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"initRules.js","sourceRoot":"","sources":["../../../src/analyze/helpers/initRules.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,aAAa,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,CAAO,OAAe,EAAiB,EAAE;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAE7C,+BAA+B;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,
|
|
1
|
+
{"version":3,"file":"initRules.js","sourceRoot":"","sources":["../../../src/analyze/helpers/initRules.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,aAAa,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,aAAa,GAAG,CAAO,OAAe,EAAiB,EAAE;IAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC3D,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAElC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAE7C,+BAA+B;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAC3B,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,CACnH,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACf,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACjE,CAAC;IAED,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;IAChD,+CAA+C;IAC/C,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/E,6EAA6E;IAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC1D,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;AACpE,CAAC,CAAA,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAG,GAAwB,EAAE;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAErD,0BAA0B;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAEjC,0CAA0C;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QACnD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACvE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACtF,6BAA6B;QAC7B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAED,yGAAyG;IACzG,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACrG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC1C,IAAI,IAAI,OAAO,EAAE,KAAK,gBAAgB,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAC;YAC3F,6BAA6B;YAC7B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC,CAAC;IACrF,CAAC;AACL,CAAC,CAAA,CAAC;AAEF,eAAe,SAAS,CAAC"}
|
package/build/globalConfig.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
const githubURL = "https://github.com/js-recon/js-recon";
|
|
2
2
|
const modulesDocs = "https://js-recon.io/docs/category/modules";
|
|
3
|
-
const version = "1.4.1-
|
|
3
|
+
const version = "1.4.1-beta.1";
|
|
4
4
|
const toolDesc = "JavaScript Enumeration and SAST";
|
|
5
5
|
const axiosNonHttpMethods = ["isAxiosError"]; // methods available in axios, which are not for making HTTP requests
|
|
6
6
|
let CONFIG = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"globalConfig.js","sourceRoot":"","sources":["../src/globalConfig.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,OAAO,GAAG,
|
|
1
|
+
{"version":3,"file":"globalConfig.js","sourceRoot":"","sources":["../src/globalConfig.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAChE,MAAM,OAAO,GAAG,cAAc,CAAC;AAC/B,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,mBAAmB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,qEAAqE;AAEnH,IAAI,MAAM,GAAG;IACT,MAAM,EAAE,SAAS;IACjB,WAAW,EAAE,WAAW;IACxB,eAAe,EAAE,qFAAqF,SAAS,kCAAkC;IACjJ,OAAO,EAAE,OAAO;IAChB,QAAQ,EAAE,QAAQ;IAClB,mBAAmB,EAAE,mBAAmB;IACxC,QAAQ,EAAE,GAAG,SAAS,oBAAoB;CAC7C,CAAC;AAEF,eAAe,MAAM,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,10 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"permissions": {
|
|
3
|
-
"allow": [
|
|
4
|
-
"Bash(npm view *)",
|
|
5
|
-
"Bash(python3 -c \"import json, sys; v=json.load\\(sys.stdin\\); stable=[x for x in v if all\\(c not in x for c in ['alpha','beta','rc','canary','next','experimental','-']\\)]; print\\('\\\\n'.join\\(stable[-30:]\\)\\)\")",
|
|
6
|
-
"Bash(npm install *)",
|
|
7
|
-
"Bash(npx vitest *)"
|
|
8
|
-
]
|
|
9
|
-
}
|
|
10
|
-
}
|