@js-recon/js-recon 1.4.3 → 2.0.1-alpha.1

package/.claude-sync/sync.sh

@@ -61,4 +61,4 @@ while IFS= read -r src; do
     ln -sf "$src" "$dest"
 done < <(find "$AGENTIC_REPO_PATH" \( -name "CLAUDE.md" -o -path "*/.claude/skills/*" -o -path "*/.claude/agents/*" \) -type f -not -path "*/.git/*")
 
-echo "[claude-sync] synced CLAUDE.md files for branch '$CURRENT_BRANCH'"
+echo "[claude-sync] synced CLAUDE.md / skills / agents files for branch '$CURRENT_BRANCH'"

package/.github/workflows/build-and-prettify.yaml

@@ -5,6 +5,9 @@ on:
     branches-ignore:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   version_check:
     if: |
@@ -56,6 +59,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: audit
     environment: commit-signing
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -64,7 +69,7 @@ jobs:
           ref: ${{ github.ref_name }}
 
       - name: Configure SSH commit signing
-        uses: shriyanss/verified-commit-action@v1
+        uses: shriyanss/verified-commit-action@1d7638e44a6bab6d3ac35653af7ef9f343074662 # v1.0.2
         with:
           ssh-private-key: ${{ secrets.JS_RECON_SIGNING_KEY }}
           commit-name: "js-recon-bot"
@@ -115,8 +120,29 @@ jobs:
       - name: Run unit tests
         run: npm test
 
+  lint:
+    needs: prettier
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.ref_name }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run ESLint
+        run: npm run lint
+
   build:
-    needs: test
+    needs: [test, lint]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -165,13 +191,15 @@ jobs:
           path: js-recon-labs
 
       - name: Checkout js-recon-rules
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: js-recon/js-recon-rules
-          path: js-recon-rules
-          # Keep the checkout token out of js-recon-rules/.git/config — this
-          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
-          persist-credentials: false
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          if git ls-remote --exit-code --heads https://github.com/js-recon/js-recon-rules.git "$BRANCH" > /dev/null 2>&1; then
+            echo "Using js-recon-rules branch: $BRANCH"
+          else
+            echo "js-recon-rules has no '$BRANCH' branch, falling back to dev"
+            BRANCH="dev"
+          fi
+          git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -218,14 +246,14 @@ jobs:
           docker rm js-recon-run
 
       - name: Verify all rules fired
-        run: node scripts/smoke-test.js
+        run: node scripts/smoke-test.js "$(find output -name analyze.json | head -n1)"
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: analyze-json-docker
-          path: output/localhost_3001/analyze.json
+          path: output/**/analyze.json
           if-no-files-found: ignore
 
       - name: Build the rules-bundled (-w-rules) image
@@ -252,14 +280,14 @@ jobs:
           }
 
       - name: Verify all rules fired (w-rules image)
-        run: node scripts/smoke-test.js output-w-rules/localhost_3001/analyze.json
+        run: node scripts/smoke-test.js "$(find output-w-rules -name analyze.json | head -n1)"
 
       - name: Upload w-rules analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: analyze-json-docker-w-rules
-          path: output-w-rules/localhost_3001/analyze.json
+          path: output-w-rules/**/analyze.json
           if-no-files-found: ignore
 
   integration-test-macos:
@@ -279,13 +307,15 @@ jobs:
           path: js-recon-labs
 
       - name: Checkout js-recon-rules
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: js-recon/js-recon-rules
-          path: js-recon-rules
-          # Keep the checkout token out of js-recon-rules/.git/config — this
-          # context is consumed by later build/run steps (incl. Dockerfile.w-rules).
-          persist-credentials: false
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          if git ls-remote --exit-code --heads https://github.com/js-recon/js-recon-rules.git "$BRANCH" > /dev/null 2>&1; then
+            echo "Using js-recon-rules branch: $BRANCH"
+          else
+            echo "js-recon-rules has no '$BRANCH' branch, falling back to dev"
+            BRANCH="dev"
+          fi
+          git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -343,12 +373,12 @@ jobs:
           PUPPETEER_EXECUTABLE_PATH: /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
 
       - name: Verify all rules fired
-        run: node scripts/smoke-test.js
+        run: node scripts/smoke-test.js "$(find output -name analyze.json | head -n1)"
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: analyze-json-macos
-          path: output/localhost_3001/analyze.json
+          path: output/**/analyze.json
           if-no-files-found: ignore

package/.github/workflows/codeql.yml

@@ -0,0 +1,33 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - dev
+      - main
+  pull_request:
+    branches:
+      - dev
+  schedule:
+    - cron: "0 6 * * 1" # weekly, Monday 06:00 UTC
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (javascript-typescript)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          languages: javascript-typescript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        with:
+          category: "/language:javascript-typescript"

package/.github/workflows/exploit-smoke-test.yaml

@@ -0,0 +1,160 @@
+name: Exploit Smoke Test
+
+on:
+  push:
+    branches-ignore:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  exploit-smoke-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+
+      - name: Install js-recon dependencies
+        run: npm ci
+
+      - name: Build js-recon
+        run: npm run build
+
+      # --- Next.js: CVE-2025-29927 (middleware bypass) ---
+      - name: Build cve-2025-29927 fixture
+        working-directory: js-recon-labs/next_js/cve-2025-29927
+        run: npm install && npm run build
+
+      - name: Start cve-2025-29927 fixture
+        working-directory: js-recon-labs/next_js/cve-2025-29927
+        run: npm start &
+
+      # --- Next.js: CVE-2026-64645 (rewrites SSRF) ---
+      - name: Build cve-2026-64645 fixture
+        working-directory: js-recon-labs/next_js/cve-2026-64645
+        run: npm install && npm run build
+
+      - name: Start cve-2026-64645 fixture
+        working-directory: js-recon-labs/next_js/cve-2026-64645
+        run: ./start.sh &
+
+      # --- Next.js: CVE-2025-55182 (React Flight RCE) ---
+      - name: Install cve-2025-55182 fixture dependencies
+        working-directory: js-recon-labs/next_js/cve-2025-55182
+        run: npm install
+
+      - name: Start cve-2025-55182 fixture
+        working-directory: js-recon-labs/next_js/cve-2025-55182
+        run: npm start &
+
+      # --- Vite: CVE-2025-30208 (fs.deny double-'?' bypass) ---
+      - name: Install cve-2025-30208 fixture dependencies
+        working-directory: js-recon-labs/vite/cve-2025-30208
+        run: npm install
+
+      - name: Start cve-2025-30208 fixture
+        working-directory: js-recon-labs/vite/cve-2025-30208
+        run: npm run dev &
+
+      # --- Vite: CVE-2026-39363 (WebSocket fetchModule bypass) ---
+      - name: Install cve-2026-39363 fixture dependencies
+        working-directory: js-recon-labs/vite/cve-2026-39363
+        run: npm install
+
+      - name: Start cve-2026-39363 fixture
+        working-directory: js-recon-labs/vite/cve-2026-39363
+        run: npm run dev &
+
+      # --- Nuxt: CVE-2026-71320 (Server Island RCE) ---
+      - name: Build cve-2026-71320 fixture
+        working-directory: js-recon-labs/nuxt/cve-2026-71320
+        run: npm install && npm run build
+
+      - name: Start cve-2026-71320 fixture
+        working-directory: js-recon-labs/nuxt/cve-2026-71320
+        run: npm start &
+
+      # --- Nuxt: CVE-2026-71315 (route-rule casing bypass) ---
+      - name: Build cve-2026-71315 fixture
+        working-directory: js-recon-labs/nuxt/cve-2026-71315
+        run: npm install && npm run build
+
+      - name: Start cve-2026-71315 fixture
+        working-directory: js-recon-labs/nuxt/cve-2026-71315
+        run: npm start &
+
+      # --- Angular: CVE-2026-68945 (HttpTransferCache collision) ---
+      - name: Build cve-2026-68945 fixture
+        working-directory: js-recon-labs/angular/cve-2026-68945
+        run: npm install && npm run build
+
+      - name: Start cve-2026-68945 fixture
+        working-directory: js-recon-labs/angular/cve-2026-68945
+        # CommonEngine's own allowedHosts safety net (unrelated to this CVE) rejects every
+        # request's Host header by default.
+        run: NG_ALLOWED_HOSTS=localhost npm start &
+
+      - name: Wait for all fixtures to be ready
+        run: |
+          # -f (fail on HTTP error status) is deliberately NOT used here: several fixtures 404 on
+          # a bare GET / (e.g. cve-2026-71315 has no pages/index.vue, only /login /Admin
+          # /testauth) or only accept POST with specific headers (cve-2025-55182). Any HTTP
+          # response — including a 404 — proves the process is up and listening, which is all
+          # this readiness check needs; the exploit module's own baseline/payload requests handle
+          # whatever status codes the real routes return.
+          for port in 3020 3021 3022 3023 3024 3025 3026 3027; do
+            echo "Waiting for app on port $port..."
+            timeout 90 bash -c "until curl -s -o /dev/null http://localhost:$port; do sleep 2; done"
+          done
+          echo "All fixtures ready."
+
+      - name: Run exploit module against every fixture
+        run: |
+          set -e
+          declare -A TARGETS=(
+            ["CVE-2025-29927"]="http://localhost:3020/admin"
+            ["CVE-2026-64645"]="http://localhost:3021/proxy"
+            ["CVE-2025-30208"]="http://localhost:3022"
+            ["CVE-2026-39363"]="http://localhost:3023"
+            ["CVE-2026-71320"]="http://localhost:3024"
+            ["CVE-2026-71315"]="http://localhost:3025"
+            ["CVE-2026-68945"]="http://localhost:3026"
+            ["CVE-2025-55182"]="http://localhost:3027"
+          )
+          mkdir -p /tmp/exploit-results
+          for cve in "${!TARGETS[@]}"; do
+            echo "Running exploit for $cve against ${TARGETS[$cve]}"
+            node build/index.js exploit \
+              -u "${TARGETS[$cve]}" \
+              --cve "$cve" \
+              --exec-cmd id \
+              -o "/tmp/exploit-results/$cve.json" \
+              --engine-output "/tmp/exploit-results/$cve-engine.json" \
+              --timeout 20000 || true
+          done
+
+      - name: Verify all CVEs reported vulnerable
+        run: node scripts/exploit-smoke-test.js /tmp/exploit-results
+
+      - name: Upload exploit results on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: exploit-results
+          path: /tmp/exploit-results/**
+          if-no-files-found: ignore

package/.github/workflows/framework-detection-smoke-test.yaml

@@ -0,0 +1,135 @@
+name: Framework Detection Smoke Test
+
+on:
+  push:
+    branches:
+      - dev
+      - main
+  pull_request:
+    branches:
+      - dev
+      - main
+  release:
+    types:
+      - published
+
+permissions:
+  contents: read
+
+jobs:
+  framework-detection-smoke-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout js-recon
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Checkout js-recon-labs
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: js-recon/js-recon-labs
+          path: js-recon-labs
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+
+      - name: Install js-recon dependencies
+        run: npm ci
+
+      - name: Build js-recon
+        run: npm run build
+
+      - name: Start next_js detection app (port 3010)
+        working-directory: js-recon-labs/detection/next_js
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3010..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3010 > /dev/null; do sleep 2; done'
+
+      - name: Start vue detection app (port 3011)
+        working-directory: js-recon-labs/detection/vue
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3011..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3011 > /dev/null; do sleep 2; done'
+
+      - name: Start nuxt detection app (port 3012)
+        working-directory: js-recon-labs/detection/nuxt
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3012..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3012 > /dev/null; do sleep 2; done'
+
+      - name: Start svelte detection app (port 3013)
+        working-directory: js-recon-labs/detection/svelte
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3013..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3013 > /dev/null; do sleep 2; done'
+
+      - name: Start angular detection app (port 3014)
+        working-directory: js-recon-labs/detection/angular
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3014..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3014 > /dev/null; do sleep 2; done'
+
+      - name: Start react-vite detection app (port 3015)
+        working-directory: js-recon-labs/detection/react_vite
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3015..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3015 > /dev/null; do sleep 2; done'
+
+      - name: Start react-webpack detection app (port 3016)
+        working-directory: js-recon-labs/detection/react_webpack
+        run: |
+          npm ci
+          npm run build
+          npm start &
+          echo "Waiting for app on port 3016..."
+          timeout 60 bash -c 'until curl -sf http://localhost:3016 > /dev/null; do sleep 2; done'
+
+      - name: Run js-recon fingerprint against all detection apps
+        run: |
+          cat > /tmp/framework-urls.txt << 'EOF'
+          http://localhost:3010
+          http://localhost:3011
+          http://localhost:3012
+          http://localhost:3013
+          http://localhost:3014
+          http://localhost:3015
+          http://localhost:3016
+          EOF
+          node --max-old-space-size=4096 build/index.js fingerprint \
+            -u /tmp/framework-urls.txt \
+            -f json \
+            -o /tmp/fingerprint-result \
+            -t 3 \
+            --no-sandbox
+
+      - name: Verify all frameworks detected correctly
+        run: node scripts/framework-detect-smoke-test.js /tmp/fingerprint-result.json
+
+      - name: Upload fingerprint result on failure
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: fingerprint-result
+          path: /tmp/fingerprint-result.json
+          if-no-files-found: ignore

package/.github/workflows/plumber.yml

@@ -0,0 +1,20 @@
+name: Plumber
+
+on:
+  push: {}
+  pull_request: null
+  workflow_dispatch: null
+
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: getplumber/plumber@ef9864df81f444647d95889d98695434f6fa9732 # v0.4.12, 2026-07-20
+        with:
+          score-push: true

package/.github/workflows/promote-js-recon.yml

@@ -18,6 +18,8 @@ jobs:
   update-homebrew-tap:
     runs-on: ubuntu-latest
     environment: homebrew-publish
+    permissions:
+      contents: read
     steps:
       - name: Fetch published tarball and compute SHA256
         id: sha256
@@ -93,7 +95,7 @@ jobs:
           # Dockerfile.w-rules builds from this context and would otherwise bake
           # the writable GHCR credential into an image layer.
           persist-credentials: false
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -203,7 +205,7 @@ jobs:
         with:
           node-version: "22"
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -271,7 +273,7 @@ jobs:
         with:
           node-version: "22"
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

package/.github/workflows/publish-js-recon.yml

@@ -7,6 +7,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   version_check:
     runs-on: ubuntu-latest
@@ -90,12 +93,14 @@ jobs:
       - publish-npm
     runs-on: ubuntu-latest
     environment: commit-signing
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Configure SSH commit signing
-        uses: shriyanss/verified-commit-action@v1
+        uses: shriyanss/verified-commit-action@1d7638e44a6bab6d3ac35653af7ef9f343074662 # v1.0.2
         with:
           ssh-private-key: ${{ secrets.JS_RECON_SIGNING_KEY }}
           commit-name: "js-recon-bot"

package/.github/workflows/rules-smoke-test.yaml

@@ -5,6 +5,9 @@ on:
     branches-ignore:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   rules-smoke-test:
     runs-on: ubuntu-latest
@@ -21,10 +24,15 @@ jobs:
           path: js-recon-labs
 
       - name: Checkout js-recon-rules
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: js-recon/js-recon-rules
-          path: js-recon-rules
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          if git ls-remote --exit-code --heads https://github.com/js-recon/js-recon-rules.git "$BRANCH" > /dev/null 2>&1; then
+            echo "Using js-recon-rules branch: $BRANCH"
+          else
+            echo "js-recon-rules has no '$BRANCH' branch, falling back to dev"
+            BRANCH="dev"
+          fi
+          git clone --depth 1 --branch "$BRANCH" https://github.com/js-recon/js-recon-rules.git js-recon-rules
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -68,12 +76,12 @@ jobs:
           PUPPETEER_EXECUTABLE_PATH: /usr/bin/google-chrome-stable
 
       - name: Verify all rules fired
-        run: node scripts/smoke-test.js
+        run: node scripts/smoke-test.js "$(find output -name analyze.json | head -n1)"
 
       - name: Upload analyze.json on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: analyze-json
-          path: output/localhost_3001/analyze.json
+          path: output/**/analyze.json
           if-no-files-found: ignore

package/.nvmrc

@@ -0,0 +1 @@
+22