@js-recon/js-recon 1.4.4 → 2.0.1-alpha.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-sync/sync.sh +1 -1
- package/.github/dependabot.yml +50 -0
- package/.github/workflows/build-and-prettify.yaml +49 -19
- package/.github/workflows/codeql.yml +33 -0
- package/.github/workflows/exploit-smoke-test.yaml +160 -0
- package/.github/workflows/framework-detection-smoke-test.yaml +135 -0
- package/.github/workflows/plumber.yml +20 -0
- package/.github/workflows/promote-js-recon.yml +5 -3
- package/.github/workflows/publish-js-recon.yml +31 -2
- package/.github/workflows/rules-smoke-test.yaml +13 -5
- package/.nvmrc +1 -0
- package/.plumber.yaml +151 -0
- package/CHANGELOG.md +55 -0
- package/CONTRIBUTING.md +32 -0
- package/Dockerfile +1 -0
- package/README.md +3 -2
- package/SECURITY.md +1 -1
- package/build/analyze/engine/astEngine.js +10 -9
- package/build/analyze/engine/astEngine.js.map +1 -1
- package/build/analyze/engine/csMastSEngine.js +6 -6
- package/build/analyze/engine/csMastSEngine.js.map +1 -1
- package/build/analyze/engine/index.js +1 -1
- package/build/analyze/engine/index.js.map +1 -1
- package/build/analyze/engine/requestEngine.js +6 -6
- package/build/analyze/engine/requestEngine.js.map +1 -1
- package/build/analyze/helpers/determineCompatibleVersion.js +70 -0
- package/build/analyze/helpers/determineCompatibleVersion.js.map +1 -0
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js +9 -3
- package/build/analyze/helpers/engineHelpers/findMemberExpressionAssignment.js.map +1 -1
- package/build/analyze/helpers/initRules.js +9 -9
- package/build/analyze/helpers/initRules.js.map +1 -1
- package/build/analyze/helpers/outputHelper.js +3 -3
- package/build/analyze/helpers/outputHelper.js.map +1 -1
- package/build/analyze/helpers/schemas.js +1 -0
- package/build/analyze/helpers/schemas.js.map +1 -1
- package/build/analyze/helpers/validate.js +9 -5
- package/build/analyze/helpers/validate.js.map +1 -1
- package/build/analyze/index.js +26 -16
- package/build/analyze/index.js.map +1 -1
- package/build/cliProgram.js +733 -0
- package/build/cliProgram.js.map +1 -0
- package/build/completion/index.js +247 -382
- package/build/completion/index.js.map +1 -1
- package/build/completion/introspect.js +17 -0
- package/build/completion/introspect.js.map +1 -0
- package/build/config/applicationConfig.js +3 -2
- package/build/config/applicationConfig.js.map +1 -1
- package/build/cs_mast/index.js +18 -17
- package/build/cs_mast/index.js.map +1 -1
- package/build/endpoints/gen_report/gen_json.js +2 -2
- package/build/endpoints/gen_report/gen_json.js.map +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js +1 -1
- package/build/endpoints/gen_report/utility/iterate_n_store.js.map +1 -1
- package/build/endpoints/index.js +12 -12
- package/build/endpoints/index.js.map +1 -1
- package/build/endpoints/next_js/client_jsFilesHref.js +3 -3
- package/build/endpoints/next_js/client_jsFilesHref.js.map +1 -1
- package/build/endpoints/next_js/client_jsonParse.js +4 -4
- package/build/endpoints/next_js/client_jsonParse.js.map +1 -1
- package/build/endpoints/next_js/client_mappedJsonFile.js +6 -6
- package/build/endpoints/next_js/client_mappedJsonFile.js.map +1 -1
- package/build/endpoints/next_js/client_subsequentRequests.js +5 -5
- package/build/endpoints/next_js/client_subsequentRequests.js.map +1 -1
- package/build/exploit/angular/cve-2026-68945.js +61 -0
- package/build/exploit/angular/cve-2026-68945.js.map +1 -0
- package/build/exploit/index.js +60 -0
- package/build/exploit/index.js.map +1 -0
- package/build/exploit/next/cve-2025-29927.js +65 -0
- package/build/exploit/next/cve-2025-29927.js.map +1 -0
- package/build/exploit/next/cve-2026-64645.js +51 -0
- package/build/exploit/next/cve-2026-64645.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71315.js +47 -0
- package/build/exploit/nuxt/cve-2026-71315.js.map +1 -0
- package/build/exploit/nuxt/cve-2026-71320.js +114 -0
- package/build/exploit/nuxt/cve-2026-71320.js.map +1 -0
- package/build/exploit/react/cve-2025-55182.js +116 -0
- package/build/exploit/react/cve-2025-55182.js.map +1 -0
- package/build/exploit/registry/cveRegistry.js +115 -0
- package/build/exploit/registry/cveRegistry.js.map +1 -0
- package/build/exploit/types.js +2 -0
- package/build/exploit/types.js.map +1 -0
- package/build/exploit/utility/compareResponses.js +29 -0
- package/build/exploit/utility/compareResponses.js.map +1 -0
- package/build/exploit/utility/outputHelper.js +22 -0
- package/build/exploit/utility/outputHelper.js.map +1 -0
- package/build/exploit/utility/rawRequest.js +56 -0
- package/build/exploit/utility/rawRequest.js.map +1 -0
- package/build/exploit/utility/sandboxRce.js +49 -0
- package/build/exploit/utility/sandboxRce.js.map +1 -0
- package/build/exploit/utility/toEngineOutput.js +28 -0
- package/build/exploit/utility/toEngineOutput.js.map +1 -0
- package/build/exploit/utility/wsClient.js +78 -0
- package/build/exploit/utility/wsClient.js.map +1 -0
- package/build/exploit/vite/cve-2025-30208.js +44 -0
- package/build/exploit/vite/cve-2025-30208.js.map +1 -0
- package/build/exploit/vite/cve-2026-39363.js +60 -0
- package/build/exploit/vite/cve-2026-39363.js.map +1 -0
- package/build/fingerprint/index.js +3 -2
- package/build/fingerprint/index.js.map +1 -1
- package/build/globalConfig.js +2 -2
- package/build/globalConfig.js.map +1 -1
- package/build/index.js +5 -596
- package/build/index.js.map +1 -1
- package/build/lazyLoad/angular/angular_getFromPageSource.js +3 -3
- package/build/lazyLoad/angular/angular_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/downloadFilesUtil.js +14 -11
- package/build/lazyLoad/downloadFilesUtil.js.map +1 -1
- package/build/lazyLoad/downloadQueue.js +9 -1
- package/build/lazyLoad/downloadQueue.js.map +1 -1
- package/build/lazyLoad/downloadResponse.js +1 -0
- package/build/lazyLoad/downloadResponse.js.map +1 -1
- package/build/lazyLoad/generic/generic_crawlPages.js +186 -0
- package/build/lazyLoad/generic/generic_crawlPages.js.map +1 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js +81 -0
- package/build/lazyLoad/generic/generic_downloadFiles.js.map +1 -0
- package/build/lazyLoad/generic/generic_extractLinks.js +79 -0
- package/build/lazyLoad/generic/generic_extractLinks.js.map +1 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js +152 -0
- package/build/lazyLoad/generic/generic_getScriptTags.js.map +1 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js +87 -0
- package/build/lazyLoad/generic/generic_importMapDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_resolveScope.js +66 -0
- package/build/lazyLoad/generic/generic_resolveScope.js.map +1 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js +122 -0
- package/build/lazyLoad/generic/generic_scanAttributesForJs.js.map +1 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js +103 -0
- package/build/lazyLoad/generic/generic_stringsDiscovery.js.map +1 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js +56 -0
- package/build/lazyLoad/generic/generic_webpackChunkPaths.js.map +1 -0
- package/build/lazyLoad/globals.js +31 -0
- package/build/lazyLoad/globals.js.map +1 -1
- package/build/lazyLoad/index.js +172 -75
- package/build/lazyLoad/index.js.map +1 -1
- package/build/lazyLoad/methodFilter.js +9 -1
- package/build/lazyLoad/methodFilter.js.map +1 -1
- package/build/lazyLoad/next_js/NextJsCrawler.js +98 -14
- package/build/lazyLoad/next_js/NextJsCrawler.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetJSScript.js +3 -3
- package/build/lazyLoad/next_js/next_GetJSScript.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js +4 -4
- package/build/lazyLoad/next_js/next_GetLazyResourcesBuildManifestJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js +17 -11
- package/build/lazyLoad/next_js/next_GetLazyResourcesWebpackJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_SubsequentRequests.js +7 -6
- package/build/lazyLoad/next_js/next_SubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js +1 -1
- package/build/lazyLoad/next_js/next_bruteForceJsFiles.js.map +1 -1
- package/build/lazyLoad/next_js/next_buildId.js +2 -2
- package/build/lazyLoad/next_js/next_buildId.js.map +1 -1
- package/build/lazyLoad/next_js/next_getClientSidePaths.js +2 -2
- package/build/lazyLoad/next_js/next_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/next_js/next_parseLayoutJs.js +6 -6
- package/build/lazyLoad/next_js/next_parseLayoutJs.js.map +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js +1 -1
- package/build/lazyLoad/next_js/next_promiseResolve.js.map +1 -1
- package/build/lazyLoad/next_js/next_routerStateForge.js +407 -0
- package/build/lazyLoad/next_js/next_routerStateForge.js.map +1 -0
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js +1 -1
- package/build/lazyLoad/next_js/next_scriptTagsSubsequentRequests.js.map +1 -1
- package/build/lazyLoad/next_js/next_serverActionIdScan.js +77 -0
- package/build/lazyLoad/next_js/next_serverActionIdScan.js.map +1 -0
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js +15 -13
- package/build/lazyLoad/nuxt_js/nuxt_astParse.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js +2 -2
- package/build/lazyLoad/nuxt_js/nuxt_getBuildsManifest.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js +3 -3
- package/build/lazyLoad/nuxt_js/nuxt_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js +29 -5
- package/build/lazyLoad/nuxt_js/nuxt_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/react/react_sourcemapUrls.js +7 -28
- package/build/lazyLoad/react/react_sourcemapUrls.js.map +1 -1
- package/build/lazyLoad/react/react_webpackChunkPaths.js +10 -202
- package/build/lazyLoad/react/react_webpackChunkPaths.js.map +1 -1
- package/build/lazyLoad/researchUtils.js +15 -0
- package/build/lazyLoad/researchUtils.js.map +1 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js +218 -0
- package/build/lazyLoad/shared/webpackChunkParsers.js.map +1 -0
- package/build/lazyLoad/sourcemap.js +120 -0
- package/build/lazyLoad/sourcemap.js.map +1 -1
- package/build/lazyLoad/stagnation/stagnationMonitor.js +63 -0
- package/build/lazyLoad/stagnation/stagnationMonitor.js.map +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js +1 -0
- package/build/lazyLoad/svelte/svelte_discoverPagesFromJs.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js +5 -5
- package/build/lazyLoad/svelte/svelte_getFromPageSource.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_getVersionJson.js +2 -2
- package/build/lazyLoad/svelte/svelte_getVersionJson.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js +6 -6
- package/build/lazyLoad/svelte/svelte_recursivePageCrawl.js.map +1 -1
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js +15 -6
- package/build/lazyLoad/svelte/svelte_stringAnalysisJSFiles.js.map +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js +1 -1
- package/build/lazyLoad/techDetect/checkAngularJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkNuxtJS.js +3 -3
- package/build/lazyLoad/techDetect/checkNuxtJS.js.map +1 -1
- package/build/lazyLoad/techDetect/checkSvelte.js +0 -1
- package/build/lazyLoad/techDetect/checkSvelte.js.map +1 -1
- package/build/lazyLoad/techDetect/checkVueJS.js +6 -6
- package/build/lazyLoad/techDetect/checkVueJS.js.map +1 -1
- package/build/lazyLoad/techDetect/index.js +17 -1
- package/build/lazyLoad/techDetect/index.js.map +1 -1
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js +2 -2
- package/build/lazyLoad/vue/vue_SingleJsFileOnHome.js.map +1 -1
- package/build/lazyLoad/vue/vue_discoverJsFiles.js +13 -11
- package/build/lazyLoad/vue/vue_discoverJsFiles.js.map +1 -1
- package/build/lazyLoad/vue/vue_getClientSidePaths.js +1 -1
- package/build/lazyLoad/vue/vue_getClientSidePaths.js.map +1 -1
- package/build/lazyLoad/vue/vue_pageSrc.js +1 -1
- package/build/lazyLoad/vue/vue_pageSrc.js.map +1 -1
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js +12 -3
- package/build/lazyLoad/vue/vue_reconstructSourceMaps.js.map +1 -1
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js +2 -2
- package/build/lazyLoad/vue/vue_recursiveClientSidePathDownload.js.map +1 -1
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js +3 -3
- package/build/lazyLoad/vue/vue_severalJsFilesHome.js.map +1 -1
- package/build/load/index.js +28 -38
- package/build/load/index.js.map +1 -1
- package/build/map/angular_js/getAngularConnections.js +6 -6
- package/build/map/angular_js/getAngularConnections.js.map +1 -1
- package/build/map/graphql/resolveGraphql.js +6 -6
- package/build/map/graphql/resolveGraphql.js.map +1 -1
- package/build/map/index.js +17 -17
- package/build/map/index.js.map +1 -1
- package/build/map/interactive-mode/commandHandler.js +278 -0
- package/build/map/interactive-mode/commandHandler.js.map +1 -0
- package/build/map/interactive-mode/commandHelpers.js +189 -0
- package/build/map/interactive-mode/commandHelpers.js.map +1 -0
- package/build/map/interactive-mode/esqueryGen.js.map +1 -0
- package/build/map/interactive-mode/helpMenu.js +11 -0
- package/build/map/interactive-mode/helpMenu.js.map +1 -0
- package/build/map/interactive-mode/inputPatch.js.map +1 -0
- package/build/map/interactive-mode/interactive.js +71 -0
- package/build/map/interactive-mode/interactive.js.map +1 -0
- package/build/map/interactive-mode/keybindings.js.map +1 -0
- package/build/map/interactive-mode/printer.js.map +1 -0
- package/build/map/interactive-mode/ui.js.map +1 -0
- package/build/map/next_js/getAxiosInstances.js +5 -5
- package/build/map/next_js/getAxiosInstances.js.map +1 -1
- package/build/map/next_js/getExports.js +4 -4
- package/build/map/next_js/getExports.js.map +1 -1
- package/build/map/next_js/getFetchInstances.js +10 -10
- package/build/map/next_js/getFetchInstances.js.map +1 -1
- package/build/map/next_js/getTurbopackConnections.js +8 -8
- package/build/map/next_js/getTurbopackConnections.js.map +1 -1
- package/build/map/next_js/getWebpackConnections.js +27 -16
- package/build/map/next_js/getWebpackConnections.js.map +1 -1
- package/build/map/next_js/interactive.js +3 -65
- package/build/map/next_js/interactive.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHandler.js +38 -290
- package/build/map/next_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/next_js/interactive_helpers/commandHelpers.js +0 -184
- package/build/map/next_js/interactive_helpers/commandHelpers.js.map +1 -1
- package/build/map/next_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/next_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/next_js/resolveAxios.js +6 -6
- package/build/map/next_js/resolveAxios.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js +4 -4
- package/build/map/next_js/resolveAxiosHelpers/findAxiosClients.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js +2 -2
- package/build/map/next_js/resolveAxiosHelpers/findAxiosInstance.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js +5 -5
- package/build/map/next_js/resolveAxiosHelpers/findCrossChunkParams.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js +10 -10
- package/build/map/next_js/resolveAxiosHelpers/handleAxiosCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js +13 -9
- package/build/map/next_js/resolveAxiosHelpers/handleZDotCreate.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js +12 -8
- package/build/map/next_js/resolveAxiosHelpers/processDirectAxiosCall.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js +11 -11
- package/build/map/next_js/resolveAxiosHelpers/processExportedEndpoints.js.map +1 -1
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js +16 -16
- package/build/map/next_js/resolveAxiosHelpers/traceAxiosInstanceExports.js.map +1 -1
- package/build/map/next_js/resolveFetch.js +23 -23
- package/build/map/next_js/resolveFetch.js.map +1 -1
- package/build/map/next_js/resolveNewRequest.js +10 -10
- package/build/map/next_js/resolveNewRequest.js.map +1 -1
- package/build/map/next_js/resolveServerActions.js +4 -4
- package/build/map/next_js/resolveServerActions.js.map +1 -1
- package/build/map/next_js/utils.js +8 -2
- package/build/map/next_js/utils.js.map +1 -1
- package/build/map/react_js/getReactConnections.js +21 -14
- package/build/map/react_js/getReactConnections.js.map +1 -1
- package/build/map/svelte_js/interactive.js +3 -54
- package/build/map/svelte_js/interactive.js.map +1 -1
- package/build/map/vue_js/getViteConnections.js +23 -16
- package/build/map/vue_js/getViteConnections.js.map +1 -1
- package/build/map/vue_js/interactive.js +3 -63
- package/build/map/vue_js/interactive.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/commandHandler.js +34 -283
- package/build/map/vue_js/interactive_helpers/commandHandler.js.map +1 -1
- package/build/map/vue_js/interactive_helpers/helpMenu.js +2 -10
- package/build/map/vue_js/interactive_helpers/helpMenu.js.map +1 -1
- package/build/map/vue_js/taint_utils.js +1 -1
- package/build/map/vue_js/taint_utils.js.map +1 -1
- package/build/map/vue_js/vue_resolveFetch.js +12 -12
- package/build/map/vue_js/vue_resolveFetch.js.map +1 -1
- package/build/map/vue_js/vue_resolveHttpClient.js +18 -18
- package/build/map/vue_js/vue_resolveHttpClient.js.map +1 -1
- package/build/map/vue_js/vue_resolveXhr.js +11 -11
- package/build/map/vue_js/vue_resolveXhr.js.map +1 -1
- package/build/mcp/chatOneShot.js +7 -7
- package/build/mcp/chatOneShot.js.map +1 -1
- package/build/mcp/claudeCodeCreds.js +5 -5
- package/build/mcp/claudeCodeCreds.js.map +1 -1
- package/build/mcp/cli.js +36 -35
- package/build/mcp/cli.js.map +1 -1
- package/build/mcp/config.js +4 -4
- package/build/mcp/config.js.map +1 -1
- package/build/mcp/index.js +7 -7
- package/build/mcp/index.js.map +1 -1
- package/build/mcp/mcpServer.js +4 -3
- package/build/mcp/mcpServer.js.map +1 -1
- package/build/mcp/skills.js +1 -0
- package/build/mcp/skills.js.map +1 -1
- package/build/mcp/tools.js +6 -5
- package/build/mcp/tools.js.map +1 -1
- package/build/proxy/detectBlockedResponse.js +2 -0
- package/build/proxy/detectBlockedResponse.js.map +1 -1
- package/build/proxy/index.js +3 -3
- package/build/proxy/index.js.map +1 -1
- package/build/refactor/index.js +83 -79
- package/build/refactor/index.js.map +1 -1
- package/build/refactor/next/index.js +69 -26
- package/build/refactor/next/index.js.map +1 -1
- package/build/refactor/next/transform.js +11 -4
- package/build/refactor/next/transform.js.map +1 -1
- package/build/refactor/next/validator.js +7 -7
- package/build/refactor/next/validator.js.map +1 -1
- package/build/refactor/react/index.js +13 -13
- package/build/refactor/react/index.js.map +1 -1
- package/build/refactor/react/validator.js +7 -7
- package/build/refactor/react/validator.js.map +1 -1
- package/build/refactor/react-vite/index.js +3 -3
- package/build/refactor/react-vite/index.js.map +1 -1
- package/build/refactor/remote/hf-client.js +1 -0
- package/build/refactor/remote/hf-client.js.map +1 -1
- package/build/refactor/remote/version-detect.js +12 -12
- package/build/refactor/remote/version-detect.js.map +1 -1
- package/build/refactor/vue/index.js +6 -6
- package/build/refactor/vue/index.js.map +1 -1
- package/build/refactor/vue/vite.js +6 -6
- package/build/refactor/vue/vite.js.map +1 -1
- package/build/report/index.js +30 -8
- package/build/report/index.js.map +1 -1
- package/build/report/swaggerJacker.js +63 -0
- package/build/report/swaggerJacker.js.map +1 -0
- package/build/report/utility/dataTables/genDataTablesPage.js +2 -1
- package/build/report/utility/dataTables/genDataTablesPage.js.map +1 -1
- package/build/report/utility/genHtml.js +316 -25
- package/build/report/utility/genHtml.js.map +1 -1
- package/build/report/utility/markdownGen/addAnalyze.js +2 -1
- package/build/report/utility/markdownGen/addAnalyze.js.map +1 -1
- package/build/report/utility/populateDb/populateAnalysisFindings.js +2 -2
- package/build/report/utility/populateDb/populateAnalysisFindings.js.map +1 -1
- package/build/report/utility/populateDb/populateEndpoints.js +3 -3
- package/build/report/utility/populateDb/populateEndpoints.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedJson.js +2 -2
- package/build/report/utility/populateDb/populateMappedJson.js.map +1 -1
- package/build/report/utility/populateDb/populateMappedOpenapi.js +3 -3
- package/build/report/utility/populateDb/populateMappedOpenapi.js.map +1 -1
- package/build/report/utility/severityColors.js +35 -0
- package/build/report/utility/severityColors.js.map +1 -0
- package/build/run/bundler-detect.js +45 -9
- package/build/run/bundler-detect.js.map +1 -1
- package/build/run/dashboard/dashboardHtml.js +150 -0
- package/build/run/dashboard/dashboardHtml.js.map +1 -0
- package/build/run/dashboard/fsBrowser.js +43 -0
- package/build/run/dashboard/fsBrowser.js.map +1 -0
- package/build/run/dashboard/server.js +123 -0
- package/build/run/dashboard/server.js.map +1 -0
- package/build/run/dashboard/state.js +97 -0
- package/build/run/dashboard/state.js.map +1 -0
- package/build/run/index.js +177 -110
- package/build/run/index.js.map +1 -1
- package/build/run/interruptHandler.js +18 -0
- package/build/run/interruptHandler.js.map +1 -1
- package/build/sourcemaps/index.js +7 -6
- package/build/sourcemaps/index.js.map +1 -1
- package/build/strings/index.js +27 -24
- package/build/strings/index.js.map +1 -1
- package/build/strings/openapi.js +4 -4
- package/build/strings/openapi.js.map +1 -1
- package/build/strings/permutate.js +4 -4
- package/build/strings/permutate.js.map +1 -1
- package/build/strings/secrets.js +1 -0
- package/build/strings/secrets.js.map +1 -1
- package/build/strings/trufflehog.js +66 -19
- package/build/strings/trufflehog.js.map +1 -1
- package/build/strings/trufflehogConfig.js +36 -0
- package/build/strings/trufflehogConfig.js.map +1 -0
- package/build/strings/trufflehogDownload.js +115 -0
- package/build/strings/trufflehogDownload.js.map +1 -0
- package/build/utility/ai.js +33 -4
- package/build/utility/ai.js.map +1 -1
- package/build/utility/banner.js +4 -3
- package/build/utility/banner.js.map +1 -1
- package/build/utility/cacheDb.js +78 -0
- package/build/utility/cacheDb.js.map +1 -0
- package/build/utility/configureSandbox.js +2 -2
- package/build/utility/configureSandbox.js.map +1 -1
- package/build/utility/customHeaders.js +30 -0
- package/build/utility/customHeaders.js.map +1 -0
- package/build/utility/globals.js +37 -12
- package/build/utility/globals.js.map +1 -1
- package/build/utility/heap.js +2 -1
- package/build/utility/heap.js.map +1 -1
- package/build/utility/makeReq.js +38 -87
- package/build/utility/makeReq.js.map +1 -1
- package/build/utility/openapiGenerator.js +2 -2
- package/build/utility/openapiGenerator.js.map +1 -1
- package/build/utility/printMsg.js +53 -0
- package/build/utility/printMsg.js.map +1 -0
- package/build/utility/progressLog.js +4 -3
- package/build/utility/progressLog.js.map +1 -1
- package/build/utility/resolvePath.js +2 -1
- package/build/utility/resolvePath.js.map +1 -1
- package/build/utility/ruleVersionMap.js +73 -0
- package/build/utility/ruleVersionMap.js.map +1 -0
- package/config.dist.yaml +3 -3
- package/contributing/testing.md +106 -0
- package/eslint.config.js +24 -0
- package/package.json +22 -6
- package/scripts/exploit-smoke-test.js +82 -0
- package/scripts/framework-detect-smoke-test.js +64 -0
- package/scripts/postinstall-completion.mjs +40 -0
- package/scripts/smoke-test.js +12 -0
- package/build/lazyLoad/downloadLoadedJsUtil.js +0 -98
- package/build/lazyLoad/downloadLoadedJsUtil.js.map +0 -1
- package/build/map/next_js/interactive_helpers/esqueryGen.js.map +0 -1
- package/build/map/next_js/interactive_helpers/inputPatch.js.map +0 -1
- package/build/map/next_js/interactive_helpers/keybindings.js.map +0 -1
- package/build/map/next_js/interactive_helpers/printer.js.map +0 -1
- package/build/map/next_js/interactive_helpers/ui.js.map +0 -1
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/esqueryGen.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/inputPatch.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/keybindings.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/printer.js +0 -0
- /package/build/map/{next_js/interactive_helpers → interactive-mode}/ui.js +0 -0
|
@@ -7,134 +7,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
7
7
|
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
8
8
|
});
|
|
9
9
|
};
|
|
10
|
-
var _a;
|
|
11
10
|
import makeRequest from "../../utility/makeReq.js";
|
|
12
|
-
import chalk from "chalk";
|
|
13
|
-
import _traverse from "@babel/traverse";
|
|
14
|
-
import parser from "@babel/parser";
|
|
15
|
-
import execFunc from "../../utility/runSandboxed.js";
|
|
16
11
|
import { runWithConcurrency } from "../../utility/concurrency.js";
|
|
17
|
-
|
|
12
|
+
import { extractWebpackChunkUrls } from "../shared/webpackChunkParsers.js";
|
|
13
|
+
import { printMsg, MSG } from "../../utility/printMsg.js";
|
|
18
14
|
export const deduplicateWebpackChunkPaths = (paths) => [...new Set(paths)];
|
|
19
|
-
/**
|
|
20
|
-
* Pure parser: extracts `[chunkId, chunkName]` entries from webpack's
|
|
21
|
-
* FunctionExpression object-map pattern:
|
|
22
|
-
* function(e) { return ({123: "name", ...}[e] || e) + ".js"; }
|
|
23
|
-
* Returns entries from the first qualifying object map (≥ 3 numeric-keyed string entries).
|
|
24
|
-
*/
|
|
25
|
-
export const extractObjectMapChunkEntries = (jsContent) => {
|
|
26
|
-
const result = [];
|
|
27
|
-
let ast;
|
|
28
|
-
try {
|
|
29
|
-
ast = parser.parse(jsContent, {
|
|
30
|
-
sourceType: "unambiguous",
|
|
31
|
-
plugins: ["jsx", "typescript"],
|
|
32
|
-
errorRecovery: true,
|
|
33
|
-
});
|
|
34
|
-
}
|
|
35
|
-
catch (_a) {
|
|
36
|
-
return result;
|
|
37
|
-
}
|
|
38
|
-
traverse(ast, {
|
|
39
|
-
FunctionExpression(path) {
|
|
40
|
-
var _a, _b;
|
|
41
|
-
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
42
|
-
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
43
|
-
const source = jsContent.slice(start, end);
|
|
44
|
-
if (!source.match(/\|\|\s*e/) || !source.includes('".js"'))
|
|
45
|
-
return;
|
|
46
|
-
path.traverse({
|
|
47
|
-
ObjectExpression(objPath) {
|
|
48
|
-
const props = objPath.node.properties;
|
|
49
|
-
if (props.length < 3)
|
|
50
|
-
return;
|
|
51
|
-
const entries = [];
|
|
52
|
-
for (const prop of props) {
|
|
53
|
-
if (prop.type !== "ObjectProperty")
|
|
54
|
-
continue;
|
|
55
|
-
const key = prop.key;
|
|
56
|
-
const value = prop.value;
|
|
57
|
-
if (value.type !== "StringLiteral")
|
|
58
|
-
continue;
|
|
59
|
-
let keyNum = null;
|
|
60
|
-
if (key.type === "NumericLiteral")
|
|
61
|
-
keyNum = key.value;
|
|
62
|
-
else if (key.type === "StringLiteral" && /^\d+$/.test(key.value))
|
|
63
|
-
keyNum = parseInt(key.value);
|
|
64
|
-
else if (key.type === "Identifier" && /^\d+$/.test(key.name))
|
|
65
|
-
keyNum = parseInt(key.name);
|
|
66
|
-
if (keyNum === null)
|
|
67
|
-
continue;
|
|
68
|
-
entries.push([keyNum, value.value]);
|
|
69
|
-
}
|
|
70
|
-
if (entries.length >= 3) {
|
|
71
|
-
result.push(...entries);
|
|
72
|
-
objPath.stop();
|
|
73
|
-
path.stop();
|
|
74
|
-
}
|
|
75
|
-
},
|
|
76
|
-
});
|
|
77
|
-
},
|
|
78
|
-
});
|
|
79
|
-
return result;
|
|
80
|
-
};
|
|
81
|
-
/**
|
|
82
|
-
* Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
|
|
83
|
-
* if-chain pattern:
|
|
84
|
-
* (e) => { if (123 === e) return "name.js"; if (456 === e) return "other.js"; ... }
|
|
85
|
-
* Returns filenames only when there are at least 3 qualifying if-statements.
|
|
86
|
-
*/
|
|
87
|
-
export const extractIfChainChunkFilenames = (jsContent) => {
|
|
88
|
-
const result = [];
|
|
89
|
-
let ast;
|
|
90
|
-
try {
|
|
91
|
-
ast = parser.parse(jsContent, {
|
|
92
|
-
sourceType: "unambiguous",
|
|
93
|
-
plugins: ["jsx", "typescript"],
|
|
94
|
-
errorRecovery: true,
|
|
95
|
-
});
|
|
96
|
-
}
|
|
97
|
-
catch (_a) {
|
|
98
|
-
return result;
|
|
99
|
-
}
|
|
100
|
-
traverse(ast, {
|
|
101
|
-
ArrowFunctionExpression(path) {
|
|
102
|
-
var _a, _b;
|
|
103
|
-
const body = path.node.body;
|
|
104
|
-
if (body.type !== "BlockStatement")
|
|
105
|
-
return;
|
|
106
|
-
// skip expression-body arrows (handled by execFunc path)
|
|
107
|
-
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
108
|
-
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
109
|
-
const source = jsContent.slice(start, end);
|
|
110
|
-
if (source.match(/"\.js".{0,15}$/))
|
|
111
|
-
return;
|
|
112
|
-
const filenames = [];
|
|
113
|
-
for (const stmt of body.body) {
|
|
114
|
-
if (stmt.type !== "IfStatement")
|
|
115
|
-
continue;
|
|
116
|
-
const test = stmt.test;
|
|
117
|
-
if (test.type !== "BinaryExpression" || test.operator !== "===")
|
|
118
|
-
continue;
|
|
119
|
-
const { left, right } = test;
|
|
120
|
-
const isNumericEqParam = (left.type === "NumericLiteral" && right.type === "Identifier") ||
|
|
121
|
-
(right.type === "NumericLiteral" && left.type === "Identifier");
|
|
122
|
-
if (!isNumericEqParam)
|
|
123
|
-
continue;
|
|
124
|
-
const consequent = stmt.consequent;
|
|
125
|
-
if (consequent.type !== "ReturnStatement" || !consequent.argument)
|
|
126
|
-
continue;
|
|
127
|
-
const arg = consequent.argument;
|
|
128
|
-
if (arg.type !== "StringLiteral" || !arg.value.endsWith(".js"))
|
|
129
|
-
continue;
|
|
130
|
-
filenames.push(arg.value);
|
|
131
|
-
}
|
|
132
|
-
if (filenames.length >= 3)
|
|
133
|
-
result.push(...filenames);
|
|
134
|
-
},
|
|
135
|
-
});
|
|
136
|
-
return result;
|
|
137
|
-
};
|
|
138
15
|
// url param kept for API consistency with other react_* functions
|
|
139
16
|
const react_webpackChunkPaths = (_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1) => __awaiter(void 0, [_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1], void 0, function* (_url, maxJsSizeMb, jsFiles, threads = 1) {
|
|
140
17
|
let toReturn = [];
|
|
@@ -145,96 +22,27 @@ const react_webpackChunkPaths = (_url_1, maxJsSizeMb_1, jsFiles_1, ...args_1) =>
|
|
|
145
22
|
return;
|
|
146
23
|
const contentLength = req.headers.get("content-length");
|
|
147
24
|
if (contentLength && parseInt(contentLength) > maxJsSizeMb * 1024 * 1024) {
|
|
148
|
-
|
|
25
|
+
printMsg(MSG.Warn, `[!] Skipping ${jsFile} (too large)`);
|
|
149
26
|
return;
|
|
150
27
|
}
|
|
151
28
|
const jsContent = yield req.text();
|
|
152
29
|
if (jsContent.length > maxJsSizeMb * 1024 * 1024) {
|
|
153
|
-
|
|
30
|
+
printMsg(MSG.Warn, `[!] Skipping ${jsFile} (too large)`);
|
|
154
31
|
return;
|
|
155
32
|
}
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
for (const [, chunkName] of objectMapEntries) {
|
|
161
|
-
try {
|
|
162
|
-
const finalUrl = new URL("../" + chunkName + ".js", jsFile).href;
|
|
163
|
-
toReturn.push(finalUrl);
|
|
164
|
-
}
|
|
165
|
-
catch (_a) {
|
|
166
|
-
// skip filenames that fail URL resolution
|
|
167
|
-
}
|
|
168
|
-
}
|
|
169
|
-
}
|
|
170
|
-
// pattern 2: ArrowFunctionExpression if-chain
|
|
171
|
-
const ifChainFilenames = extractIfChainChunkFilenames(jsContent);
|
|
172
|
-
if (ifChainFilenames.length > 0) {
|
|
173
|
-
console.log(chalk.green(`[✓] Found webpack if-chain chunk path builder in ${jsFile}`));
|
|
174
|
-
for (const filename of ifChainFilenames) {
|
|
175
|
-
try {
|
|
176
|
-
const output = filename.startsWith("/") ||
|
|
177
|
-
filename.startsWith("http") ||
|
|
178
|
-
filename.startsWith("./") ||
|
|
179
|
-
filename.startsWith("../")
|
|
180
|
-
? filename
|
|
181
|
-
: "../" + filename;
|
|
182
|
-
const finalUrl = new URL(output, jsFile).href;
|
|
183
|
-
toReturn.push(finalUrl);
|
|
184
|
-
}
|
|
185
|
-
catch (_b) {
|
|
186
|
-
// skip filenames that fail URL resolution
|
|
187
|
-
}
|
|
188
|
-
}
|
|
33
|
+
const urls = extractWebpackChunkUrls(jsContent, jsFile);
|
|
34
|
+
if (urls.length > 0) {
|
|
35
|
+
printMsg(MSG.Run, `[✓] Found ${urls.length} webpack chunk JS file(s) in ${jsFile}`);
|
|
36
|
+
toReturn.push(...urls);
|
|
189
37
|
}
|
|
190
|
-
// pattern 1: ArrowFunctionExpression expression body via execFunc
|
|
191
|
-
const ast = parser.parse(jsContent, {
|
|
192
|
-
sourceType: "unambiguous",
|
|
193
|
-
plugins: ["jsx", "typescript"],
|
|
194
|
-
errorRecovery: true,
|
|
195
|
-
});
|
|
196
|
-
traverse(ast, {
|
|
197
|
-
ArrowFunctionExpression(path) {
|
|
198
|
-
var _a, _b;
|
|
199
|
-
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
200
|
-
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
201
|
-
const source = jsContent.slice(start, end);
|
|
202
|
-
if (!source.match(/"\.js".{0,15}$/))
|
|
203
|
-
return;
|
|
204
|
-
console.log(chalk.green(`[✓] Found webpack chunk path builder in ${jsFile}`));
|
|
205
|
-
console.log(chalk.yellow(source.slice(0, 200) + (source.length > 200 ? "..." : "")));
|
|
206
|
-
const urlBuilderFunc = `(() => (${source}))()`;
|
|
207
|
-
const integers = source.match(/\d+/g);
|
|
208
|
-
if (!integers)
|
|
209
|
-
return;
|
|
210
|
-
for (const i of integers) {
|
|
211
|
-
try {
|
|
212
|
-
let output = execFunc(urlBuilderFunc, parseInt(i));
|
|
213
|
-
if (typeof output !== "string" || output.includes("undefined"))
|
|
214
|
-
continue;
|
|
215
|
-
if (!(output.startsWith("/") ||
|
|
216
|
-
output.startsWith("http") ||
|
|
217
|
-
output.startsWith("./") ||
|
|
218
|
-
output.startsWith("../"))) {
|
|
219
|
-
output = "../" + output;
|
|
220
|
-
}
|
|
221
|
-
const finalUrl = new URL(output, jsFile).href;
|
|
222
|
-
toReturn.push(finalUrl);
|
|
223
|
-
}
|
|
224
|
-
catch (_c) {
|
|
225
|
-
// skip integers that cause errors in sandboxed execution
|
|
226
|
-
}
|
|
227
|
-
}
|
|
228
|
-
},
|
|
229
|
-
});
|
|
230
38
|
}
|
|
231
39
|
catch (err) {
|
|
232
|
-
|
|
40
|
+
printMsg(MSG.Err, `[!] Error processing ${jsFile}: ${err}`);
|
|
233
41
|
}
|
|
234
42
|
}));
|
|
235
43
|
toReturn = deduplicateWebpackChunkPaths(toReturn);
|
|
236
44
|
if (toReturn.length > 0) {
|
|
237
|
-
|
|
45
|
+
printMsg(MSG.Run, `[✓] Found ${toReturn.length} webpack chunk JS files`);
|
|
238
46
|
}
|
|
239
47
|
return toReturn;
|
|
240
48
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"react_webpackChunkPaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/react/react_webpackChunkPaths.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"react_webpackChunkPaths.js","sourceRoot":"","sources":["../../../src/lazyLoad/react/react_webpackChunkPaths.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,WAAW,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,2BAA2B,CAAC;AAE1D,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,KAAwB,EAAY,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAExG,kEAAkE;AAClE,MAAM,uBAAuB,GAAG,8CAKX,EAAE,qFAJnB,IAAY,EACZ,WAAmB,EACnB,OAAiB,EACjB,UAAkB,CAAC;IAEnB,IAAI,QAAQ,GAAa,EAAE,CAAC;IAE5B,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,CAAO,MAAM,EAAE,EAAE;QACxD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;YAEtC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO;YAEvC,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACxD,IAAI,aAAa,IAAI,QAAQ,CAAC,aAAa,CAAC,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACvE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAEnC,IAAI,SAAS,CAAC,MAAM,GAAG,WAAW,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC/C,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YAED,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,IAAI,CAAC,MAAM,gCAAgC,MAAM,EAAE,CAAC,CAAC;gBACpF,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,wBAAwB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAA,CAAC,CAAC;IAEH,QAAQ,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,QAAQ,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAA,CAAC;AAEF,eAAe,uBAAuB,CAAC"}
|
|
@@ -0,0 +1,15 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Appends newly discovered URLs onto a technique's existing entry in a
|
|
3
|
+
* research-mode efficiency map, without deduplicating across techniques —
|
|
4
|
+
* the same URL may legitimately appear under multiple techniques since this
|
|
5
|
+
* measures each technique's individual yield.
|
|
6
|
+
*/
|
|
7
|
+
export const accumulateTechnique = (map, technique, urls) => {
|
|
8
|
+
if (!urls || urls.length === 0)
|
|
9
|
+
return;
|
|
10
|
+
map[technique] = [...(map[technique] || []), ...urls];
|
|
11
|
+
};
|
|
12
|
+
export const createTechniqueRecorder = (map) => {
|
|
13
|
+
return (technique, urls) => accumulateTechnique(map, technique, urls);
|
|
14
|
+
};
|
|
15
|
+
//# sourceMappingURL=researchUtils.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"researchUtils.js","sourceRoot":"","sources":["../../src/lazyLoad/researchUtils.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAA6B,EAAE,SAAiB,EAAE,IAAc,EAAQ,EAAE;IAC1G,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAA6B,EAAqB,EAAE;IACxF,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC1E,CAAC,CAAC"}
|
|
@@ -0,0 +1,218 @@
|
|
|
1
|
+
var _a;
|
|
2
|
+
import _traverse from "@babel/traverse";
|
|
3
|
+
import parser from "@babel/parser";
|
|
4
|
+
import execFunc from "../../utility/runSandboxed.js";
|
|
5
|
+
const traverse = ((_a = _traverse.default) !== null && _a !== void 0 ? _a : _traverse);
|
|
6
|
+
/**
|
|
7
|
+
* Pure parser: extracts `[chunkId, chunkName]` entries from webpack's
|
|
8
|
+
* FunctionExpression object-map pattern:
|
|
9
|
+
* function(e) { return ({123: "name", ...}[e] || e) + ".js"; }
|
|
10
|
+
* Returns entries from the first qualifying object map (≥ 3 numeric-keyed string entries).
|
|
11
|
+
*/
|
|
12
|
+
export const extractObjectMapChunkEntries = (jsContent) => {
|
|
13
|
+
const result = [];
|
|
14
|
+
let ast;
|
|
15
|
+
try {
|
|
16
|
+
ast = parser.parse(jsContent, {
|
|
17
|
+
sourceType: "unambiguous",
|
|
18
|
+
plugins: ["jsx", "typescript"],
|
|
19
|
+
errorRecovery: true,
|
|
20
|
+
});
|
|
21
|
+
}
|
|
22
|
+
catch (_a) {
|
|
23
|
+
return result;
|
|
24
|
+
}
|
|
25
|
+
traverse(ast, {
|
|
26
|
+
FunctionExpression(path) {
|
|
27
|
+
var _a, _b;
|
|
28
|
+
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
29
|
+
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
30
|
+
const source = jsContent.slice(start, end);
|
|
31
|
+
if (!source.match(/\|\|\s*e/) || !source.includes('".js"'))
|
|
32
|
+
return;
|
|
33
|
+
path.traverse({
|
|
34
|
+
ObjectExpression(objPath) {
|
|
35
|
+
const props = objPath.node.properties;
|
|
36
|
+
if (props.length < 3)
|
|
37
|
+
return;
|
|
38
|
+
const entries = [];
|
|
39
|
+
for (const prop of props) {
|
|
40
|
+
if (prop.type !== "ObjectProperty")
|
|
41
|
+
continue;
|
|
42
|
+
const key = prop.key;
|
|
43
|
+
const value = prop.value;
|
|
44
|
+
if (value.type !== "StringLiteral")
|
|
45
|
+
continue;
|
|
46
|
+
let keyNum = null;
|
|
47
|
+
if (key.type === "NumericLiteral")
|
|
48
|
+
keyNum = key.value;
|
|
49
|
+
else if (key.type === "StringLiteral" && /^\d+$/.test(key.value))
|
|
50
|
+
keyNum = parseInt(key.value);
|
|
51
|
+
else if (key.type === "Identifier" && /^\d+$/.test(key.name))
|
|
52
|
+
keyNum = parseInt(key.name);
|
|
53
|
+
if (keyNum === null)
|
|
54
|
+
continue;
|
|
55
|
+
entries.push([keyNum, value.value]);
|
|
56
|
+
}
|
|
57
|
+
if (entries.length >= 3) {
|
|
58
|
+
result.push(...entries);
|
|
59
|
+
objPath.stop();
|
|
60
|
+
path.stop();
|
|
61
|
+
}
|
|
62
|
+
},
|
|
63
|
+
});
|
|
64
|
+
},
|
|
65
|
+
});
|
|
66
|
+
return result;
|
|
67
|
+
};
|
|
68
|
+
/**
|
|
69
|
+
* Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
|
|
70
|
+
* if-chain pattern:
|
|
71
|
+
* (e) => { if (123 === e) return "name.js"; if (456 === e) return "other.js"; ... }
|
|
72
|
+
* Returns filenames only when there are at least 3 qualifying if-statements.
|
|
73
|
+
*/
|
|
74
|
+
export const extractIfChainChunkFilenames = (jsContent) => {
|
|
75
|
+
const result = [];
|
|
76
|
+
let ast;
|
|
77
|
+
try {
|
|
78
|
+
ast = parser.parse(jsContent, {
|
|
79
|
+
sourceType: "unambiguous",
|
|
80
|
+
plugins: ["jsx", "typescript"],
|
|
81
|
+
errorRecovery: true,
|
|
82
|
+
});
|
|
83
|
+
}
|
|
84
|
+
catch (_a) {
|
|
85
|
+
return result;
|
|
86
|
+
}
|
|
87
|
+
traverse(ast, {
|
|
88
|
+
ArrowFunctionExpression(path) {
|
|
89
|
+
var _a, _b;
|
|
90
|
+
const body = path.node.body;
|
|
91
|
+
if (body.type !== "BlockStatement")
|
|
92
|
+
return;
|
|
93
|
+
// skip expression-body arrows (handled by extractExpressionBodyChunkFilenames)
|
|
94
|
+
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
95
|
+
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
96
|
+
const source = jsContent.slice(start, end);
|
|
97
|
+
if (source.match(/"\.js".{0,15}$/))
|
|
98
|
+
return;
|
|
99
|
+
const filenames = [];
|
|
100
|
+
for (const stmt of body.body) {
|
|
101
|
+
if (stmt.type !== "IfStatement")
|
|
102
|
+
continue;
|
|
103
|
+
const test = stmt.test;
|
|
104
|
+
if (test.type !== "BinaryExpression" || test.operator !== "===")
|
|
105
|
+
continue;
|
|
106
|
+
const { left, right } = test;
|
|
107
|
+
const isNumericEqParam = (left.type === "NumericLiteral" && right.type === "Identifier") ||
|
|
108
|
+
(right.type === "NumericLiteral" && left.type === "Identifier");
|
|
109
|
+
if (!isNumericEqParam)
|
|
110
|
+
continue;
|
|
111
|
+
const consequent = stmt.consequent;
|
|
112
|
+
if (consequent.type !== "ReturnStatement" || !consequent.argument)
|
|
113
|
+
continue;
|
|
114
|
+
const arg = consequent.argument;
|
|
115
|
+
if (arg.type !== "StringLiteral" || !arg.value.endsWith(".js"))
|
|
116
|
+
continue;
|
|
117
|
+
filenames.push(arg.value);
|
|
118
|
+
}
|
|
119
|
+
if (filenames.length >= 3)
|
|
120
|
+
result.push(...filenames);
|
|
121
|
+
},
|
|
122
|
+
});
|
|
123
|
+
return result;
|
|
124
|
+
};
|
|
125
|
+
/**
|
|
126
|
+
* Pure parser: extracts chunk filenames from webpack's ArrowFunctionExpression
|
|
127
|
+
* expression-body pattern (e.g. `(e) => (HASHMAP[e] || e) + ".js"`) by executing the
|
|
128
|
+
* arrow in a sandbox for every integer literal referenced in its own source — the
|
|
129
|
+
* hash-map values aren't visible to plain string extraction because they're only
|
|
130
|
+
* produced by evaluating the expression.
|
|
131
|
+
*/
|
|
132
|
+
export const extractExpressionBodyChunkFilenames = (jsContent) => {
|
|
133
|
+
const result = [];
|
|
134
|
+
let ast;
|
|
135
|
+
try {
|
|
136
|
+
ast = parser.parse(jsContent, {
|
|
137
|
+
sourceType: "unambiguous",
|
|
138
|
+
plugins: ["jsx", "typescript"],
|
|
139
|
+
errorRecovery: true,
|
|
140
|
+
});
|
|
141
|
+
}
|
|
142
|
+
catch (_a) {
|
|
143
|
+
return result;
|
|
144
|
+
}
|
|
145
|
+
traverse(ast, {
|
|
146
|
+
ArrowFunctionExpression(path) {
|
|
147
|
+
var _a, _b;
|
|
148
|
+
const start = (_a = path.node.start) !== null && _a !== void 0 ? _a : 0;
|
|
149
|
+
const end = (_b = path.node.end) !== null && _b !== void 0 ? _b : jsContent.length;
|
|
150
|
+
const source = jsContent.slice(start, end);
|
|
151
|
+
if (!source.match(/"\.js".{0,15}$/))
|
|
152
|
+
return;
|
|
153
|
+
const urlBuilderFunc = `(() => (${source}))()`;
|
|
154
|
+
const integers = source.match(/\d+/g);
|
|
155
|
+
if (!integers)
|
|
156
|
+
return;
|
|
157
|
+
for (const i of integers) {
|
|
158
|
+
try {
|
|
159
|
+
const output = execFunc(urlBuilderFunc, parseInt(i));
|
|
160
|
+
if (typeof output === "string" && !output.includes("undefined")) {
|
|
161
|
+
result.push(output);
|
|
162
|
+
}
|
|
163
|
+
}
|
|
164
|
+
catch (_c) {
|
|
165
|
+
// skip integers that cause errors in sandboxed execution
|
|
166
|
+
}
|
|
167
|
+
}
|
|
168
|
+
},
|
|
169
|
+
});
|
|
170
|
+
return result;
|
|
171
|
+
};
|
|
172
|
+
/**
|
|
173
|
+
* Resolves a raw chunk filename against the file it was found in. Webpack commonly
|
|
174
|
+
* emits chunk names one directory up from the entry chunk that references them, so a
|
|
175
|
+
* bare filename (no scheme, no leading "/", "./", or "../") is resolved against "../"
|
|
176
|
+
* relative to fileUrl; anything already absolute or explicitly relative is resolved
|
|
177
|
+
* as-is.
|
|
178
|
+
*/
|
|
179
|
+
const resolveChunkUrl = (output, fileUrl) => {
|
|
180
|
+
try {
|
|
181
|
+
const normalized = output.startsWith("/") || output.startsWith("http") || output.startsWith("./") || output.startsWith("../")
|
|
182
|
+
? output
|
|
183
|
+
: "../" + output;
|
|
184
|
+
return new URL(normalized, fileUrl).href;
|
|
185
|
+
}
|
|
186
|
+
catch (_a) {
|
|
187
|
+
return null;
|
|
188
|
+
}
|
|
189
|
+
};
|
|
190
|
+
/**
|
|
191
|
+
* Runs all three webpack chunk-path-builder patterns (object-map, if-chain,
|
|
192
|
+
* expression-body) against one file's content and returns every resolved chunk URL.
|
|
193
|
+
* Shared between the React crawler (`react_webpackChunkPaths.ts`) and `generic` tech's
|
|
194
|
+
* structural discovery (`generic_webpackChunkPaths.ts`, internal#75) — these are plain
|
|
195
|
+
* webpack output patterns, not React-specific, so a webpack/module-federation entry
|
|
196
|
+
* chunk's own async-chunk hash-map can be statically enumerated regardless of which
|
|
197
|
+
* tech branch downloaded it.
|
|
198
|
+
*/
|
|
199
|
+
export const extractWebpackChunkUrls = (jsContent, fileUrl) => {
|
|
200
|
+
const urls = new Set();
|
|
201
|
+
for (const [, chunkName] of extractObjectMapChunkEntries(jsContent)) {
|
|
202
|
+
const resolved = resolveChunkUrl(`${chunkName}.js`, fileUrl);
|
|
203
|
+
if (resolved)
|
|
204
|
+
urls.add(resolved);
|
|
205
|
+
}
|
|
206
|
+
for (const filename of extractIfChainChunkFilenames(jsContent)) {
|
|
207
|
+
const resolved = resolveChunkUrl(filename, fileUrl);
|
|
208
|
+
if (resolved)
|
|
209
|
+
urls.add(resolved);
|
|
210
|
+
}
|
|
211
|
+
for (const filename of extractExpressionBodyChunkFilenames(jsContent)) {
|
|
212
|
+
const resolved = resolveChunkUrl(filename, fileUrl);
|
|
213
|
+
if (resolved)
|
|
214
|
+
urls.add(resolved);
|
|
215
|
+
}
|
|
216
|
+
return [...urls];
|
|
217
|
+
};
|
|
218
|
+
//# sourceMappingURL=webpackChunkParsers.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"webpackChunkParsers.js","sourceRoot":"","sources":["../../../src/lazyLoad/shared/webpackChunkParsers.ts"],"names":[],"mappings":";AAAA,OAAO,SAAS,MAAM,iBAAiB,CAAC;AACxC,OAAO,MAAM,MAAM,eAAe,CAAC;AACnC,OAAO,QAAQ,MAAM,+BAA+B,CAAC;AAErD,MAAM,QAAQ,GAAG,CAAC,MAAA,SAAS,CAAC,OAAO,mCAAI,SAAS,CAA6B,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAA2B,EAAE;IACvF,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,kBAAkB,CAAC,IAAI;;YACnB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO;YAEnE,IAAI,CAAC,QAAQ,CAAC;gBACV,gBAAgB,CAAC,OAAO;oBACpB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;oBACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO;oBAE7B,MAAM,OAAO,GAA4B,EAAE,CAAC;oBAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;wBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;4BAAE,SAAS;wBAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;wBACzB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;4BAAE,SAAS;wBAE7C,IAAI,MAAM,GAAkB,IAAI,CAAC;wBACjC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB;4BAAE,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;6BACjD,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;6BAC1F,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAE1F,IAAI,MAAM,KAAK,IAAI;4BAAE,SAAS;wBAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACxC,CAAC;oBAED,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACtB,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;wBACxB,OAAO,CAAC,IAAI,EAAE,CAAC;wBACf,IAAI,CAAC,IAAI,EAAE,CAAC;oBAChB,CAAC;gBACL,CAAC;aACJ,CAAC,CAAC;QACP,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAiB,EAAY,EAAE;IACxE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,uBAAuB,CAAC,IAAI;;YACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO;YAE3C,+EAA+E;YAC/E,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAE3C,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;oBAAE,SAAS;gBAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;oBAAE,SAAS;gBAC1E,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;gBAC7B,MAAM,gBAAgB,GAClB,CAAC,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;oBAC/D,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;gBACpE,IAAI,CAAC,gBAAgB;oBAAE,SAAS;gBAChC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;gBACnC,IAAI,UAAU,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,UAAU,CAAC,QAAQ;oBAAE,SAAS;gBAC5E,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;gBAChC,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACzE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YAED,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QACzD,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,SAAiB,EAAY,EAAE;IAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE;YAC1B,UAAU,EAAE,aAAa;YACzB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;YAC9B,aAAa,EAAE,IAAI;SACtB,CAAC,CAAC;IACP,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE;QACV,uBAAuB,CAAC,IAAI;;YACxB,MAAM,KAAK,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,KAAK,mCAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAA,IAAI,CAAC,IAAI,CAAC,GAAG,mCAAI,SAAS,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAAE,OAAO;YAE5C,MAAM,cAAc,GAAG,WAAW,MAAM,MAAM,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ;gBAAE,OAAO;YAEtB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBACxB,CAAC;gBACL,CAAC;gBAAC,WAAM,CAAC;oBACL,yDAAyD;gBAC7D,CAAC;YACL,CAAC;QACL,CAAC;KACJ,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,OAAe,EAAiB,EAAE;IACvE,IAAI,CAAC;QACD,MAAM,UAAU,GACZ,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACtG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;QACzB,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAY,EAAE;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,CAAC,EAAE,SAAS,CAAC,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,SAAS,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7D,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,4BAA4B,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,mCAAmC,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC"}
|
|
@@ -3,6 +3,22 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Extracts original source code from minified JavaScript using source maps.
|
|
5
5
|
*/
|
|
6
|
+
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
|
|
7
|
+
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
|
|
8
|
+
return new (P || (P = Promise))(function (resolve, reject) {
|
|
9
|
+
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
|
|
10
|
+
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
|
|
11
|
+
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
|
|
12
|
+
step((generator = generator.apply(thisArg, _arguments || [])).next());
|
|
13
|
+
});
|
|
14
|
+
};
|
|
15
|
+
import fs from "fs";
|
|
16
|
+
import path from "path";
|
|
17
|
+
import chalk from "chalk";
|
|
18
|
+
import makeRequest from "../utility/makeReq.js";
|
|
19
|
+
import { runWithConcurrency } from "../utility/concurrency.js";
|
|
20
|
+
import { progressLog } from "../utility/progressLog.js";
|
|
21
|
+
import { getSanitizedAssetFilename, resolveAssetOutputDirectory } from "./outputPath.js";
|
|
6
22
|
/**
|
|
7
23
|
* Extract original source files from a source map.
|
|
8
24
|
*
|
|
@@ -183,6 +199,110 @@ function joinPaths(base, path) {
|
|
|
183
199
|
const pathClean = path.startsWith("/") ? path.slice(1) : path;
|
|
184
200
|
return `${baseClean}/${pathClean}`;
|
|
185
201
|
}
|
|
202
|
+
/**
|
|
203
|
+
* Decode an inline `data:` URI sourceMappingURL reference into raw source-map JSON text.
|
|
204
|
+
*
|
|
205
|
+
* Handles both base64-encoded (`data:application/json;base64,<...>`, with or without a
|
|
206
|
+
* `charset` parameter) and percent-encoded (`data:application/json,<...>`) payloads.
|
|
207
|
+
* Verifies the decoded content actually looks like a source map (has a `sources` array)
|
|
208
|
+
* before returning it, so an unrelated `data:` URI that happens to be valid JSON doesn't
|
|
209
|
+
* get treated as a sourcemap.
|
|
210
|
+
*
|
|
211
|
+
* @param rawRef - The raw string following `sourceMappingURL=`
|
|
212
|
+
* @returns The decoded JSON text, or null if `rawRef` isn't a decodable inline source map
|
|
213
|
+
*/
|
|
214
|
+
export function decodeInlineSourceMapDataUri(rawRef) {
|
|
215
|
+
if (!rawRef.startsWith("data:"))
|
|
216
|
+
return null;
|
|
217
|
+
const commaIndex = rawRef.indexOf(",");
|
|
218
|
+
if (commaIndex === -1)
|
|
219
|
+
return null;
|
|
220
|
+
const meta = rawRef.slice(5, commaIndex);
|
|
221
|
+
const payload = rawRef.slice(commaIndex + 1);
|
|
222
|
+
const isBase64 = meta.split(";").includes("base64");
|
|
223
|
+
try {
|
|
224
|
+
const decoded = isBase64 ? Buffer.from(payload, "base64").toString("utf-8") : decodeURIComponent(payload);
|
|
225
|
+
const parsed = JSON.parse(decoded);
|
|
226
|
+
if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.sources))
|
|
227
|
+
return null;
|
|
228
|
+
return decoded;
|
|
229
|
+
}
|
|
230
|
+
catch (_a) {
|
|
231
|
+
return null;
|
|
232
|
+
}
|
|
233
|
+
}
|
|
234
|
+
/**
|
|
235
|
+
* Write a decoded inline source map to disk at the same location a real downloaded
|
|
236
|
+
* `.map` file for this JS URL would land at, so the existing `extractSourceMaps` disk
|
|
237
|
+
* scan (which matches by `.map` extension, not by naming convention) picks it up.
|
|
238
|
+
*
|
|
239
|
+
* Best-effort: swallows all errors, per this directory's "sourcemap fetch is best-effort"
|
|
240
|
+
* convention. Never throws.
|
|
241
|
+
*/
|
|
242
|
+
export function writeInlineSourceMap(output, jsUrl, mapContent) {
|
|
243
|
+
try {
|
|
244
|
+
const filename = getSanitizedAssetFilename(jsUrl);
|
|
245
|
+
if (!filename)
|
|
246
|
+
return;
|
|
247
|
+
const dir = resolveAssetOutputDirectory(output, jsUrl);
|
|
248
|
+
fs.mkdirSync(dir, { recursive: true });
|
|
249
|
+
fs.writeFileSync(path.join(dir, `${filename}.map`), mapContent);
|
|
250
|
+
}
|
|
251
|
+
catch (_a) {
|
|
252
|
+
// best-effort; never fatal
|
|
253
|
+
}
|
|
254
|
+
}
|
|
255
|
+
/**
|
|
256
|
+
* Discover sourcemaps referenced by a list of JS files.
|
|
257
|
+
*
|
|
258
|
+
* For each file, fetches its content and looks for a `//# sourceMappingURL=...` comment.
|
|
259
|
+
* Inline `data:` URI references are decoded and written directly to `output` (no HTTP
|
|
260
|
+
* fetch needed). Real relative/absolute references are resolved to absolute URLs and
|
|
261
|
+
* returned so the caller can enqueue them for download, same as before.
|
|
262
|
+
*
|
|
263
|
+
* @param jsFiles - JS file URLs to scan
|
|
264
|
+
* @param threads - concurrency for the fetch loop
|
|
265
|
+
* @param output - output directory inline maps are written under
|
|
266
|
+
* @returns Absolute URLs of real (non-inline) sourcemaps found
|
|
267
|
+
*/
|
|
268
|
+
export function discoverSourcemapUrls(jsFiles_1) {
|
|
269
|
+
return __awaiter(this, arguments, void 0, function* (jsFiles, threads = 1, output = "") {
|
|
270
|
+
const mapUrls = [];
|
|
271
|
+
let inlineCount = 0;
|
|
272
|
+
yield runWithConcurrency(jsFiles, threads, (jsUrl) => __awaiter(this, void 0, void 0, function* () {
|
|
273
|
+
try {
|
|
274
|
+
const res = yield makeRequest(jsUrl, { reportErrors: false });
|
|
275
|
+
if (!res)
|
|
276
|
+
return;
|
|
277
|
+
const body = yield res.text();
|
|
278
|
+
const match = body.match(/\/\/# sourceMappingURL=(.+)$/m);
|
|
279
|
+
if (!match)
|
|
280
|
+
return;
|
|
281
|
+
const rawRef = match[1].trim();
|
|
282
|
+
if (rawRef.startsWith("data:")) {
|
|
283
|
+
const decoded = decodeInlineSourceMapDataUri(rawRef);
|
|
284
|
+
if (decoded) {
|
|
285
|
+
writeInlineSourceMap(output, jsUrl, decoded);
|
|
286
|
+
inlineCount++;
|
|
287
|
+
}
|
|
288
|
+
return;
|
|
289
|
+
}
|
|
290
|
+
const mapUrl = new URL(rawRef, jsUrl).href;
|
|
291
|
+
mapUrls.push(mapUrl);
|
|
292
|
+
}
|
|
293
|
+
catch (_) {
|
|
294
|
+
// skip files that fail to fetch
|
|
295
|
+
}
|
|
296
|
+
}));
|
|
297
|
+
if (mapUrls.length > 0) {
|
|
298
|
+
progressLog(chalk.green(`[✓] Found ${mapUrls.length} sourcemaps from ${jsFiles.length} JS files`));
|
|
299
|
+
}
|
|
300
|
+
if (inlineCount > 0) {
|
|
301
|
+
progressLog(chalk.green(`[✓] Decoded ${inlineCount} inline (base64) sourcemap(s)`));
|
|
302
|
+
}
|
|
303
|
+
return mapUrls;
|
|
304
|
+
});
|
|
305
|
+
}
|
|
186
306
|
// Default export for convenience
|
|
187
307
|
export default { extractSources, extractSource, listSources, hasSourceContent };
|
|
188
308
|
//# sourceMappingURL=sourcemap.js.map
|