@jshookmcp/jshook 0.2.6 → 0.2.7

package/dist/src/modules/analyzer/CodeAnalyzerDataFlow.js

@@ -1,360 +0,0 @@
-import * as parser from '@babel/parser';
-import traverse from '@babel/traverse';
-import * as t from '@babel/types';
-import { logger } from '../../utils/logger.js';
-import { checkSanitizer } from '../analyzer/SecurityCodeAnalyzer.js';
-export async function analyzeDataFlowWithTaint(code) {
-    const graph = { nodes: [], edges: [] };
-    const sources = [];
-    const sinks = [];
-    const taintPaths = [];
-    const taintMap = new Map();
-    const sanitizers = new Set([
-        'encodeURIComponent',
-        'encodeURI',
-        'escape',
-        'decodeURIComponent',
-        'decodeURI',
-        'htmlentities',
-        'htmlspecialchars',
-        'escapeHtml',
-        'escapeHTML',
-        'he.encode',
-        'he.escape',
-        'validator.escape',
-        'validator.unescape',
-        'validator.stripLow',
-        'validator.blacklist',
-        'validator.whitelist',
-        'validator.trim',
-        'validator.isEmail',
-        'validator.isURL',
-        'validator.isInt',
-        'DOMPurify.sanitize',
-        'DOMPurify.addHook',
-        'crypto.encrypt',
-        'crypto.hash',
-        'crypto.createHash',
-        'crypto.createHmac',
-        'CryptoJS.AES.encrypt',
-        'CryptoJS.SHA256',
-        'CryptoJS.MD5',
-        'bcrypt.hash',
-        'bcrypt.compare',
-        'btoa',
-        'atob',
-        'Buffer.from',
-        'db.prepare',
-        'db.query',
-        'mysql.escape',
-        'pg.query',
-        'xss',
-        'sanitizeHtml',
-        'parseInt',
-        'parseFloat',
-        'Number',
-        'String',
-        'JSON.stringify',
-        'JSON.parse',
-        'String.prototype.replace',
-        'String.prototype.trim',
-        'Array.prototype.filter',
-        'Array.prototype.map',
-    ]);
-    try {
-        const ast = parser.parse(code, {
-            sourceType: 'module',
-            plugins: ['jsx', 'typescript'],
-        });
-        traverse(ast, {
-            CallExpression(path) {
-                const callee = path.node.callee;
-                const line = path.node.loc?.start.line || 0;
-                if (t.isMemberExpression(callee) && t.isIdentifier(callee.property)) {
-                    const methodName = callee.property.name;
-                    if (['fetch', 'ajax', 'get', 'post', 'request', 'axios'].includes(methodName)) {
-                        const sourceId = `source-network-${line}`;
-                        sources.push({ type: 'network', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sourceId,
-                            name: `${methodName}()`,
-                            type: 'source',
-                            location: { file: 'current', line },
-                        });
-                        const parent = path.parent;
-                        if (t.isVariableDeclarator(parent) && t.isIdentifier(parent.id)) {
-                            taintMap.set(parent.id.name, { sourceType: 'network', sourceLine: line });
-                        }
-                    }
-                    else if ([
-                        'querySelector',
-                        'getElementById',
-                        'getElementsByClassName',
-                        'getElementsByTagName',
-                    ].includes(methodName)) {
-                        const sourceId = `source-dom-${line}`;
-                        sources.push({ type: 'user_input', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sourceId,
-                            name: `${methodName}()`,
-                            type: 'source',
-                            location: { file: 'current', line },
-                        });
-                    }
-                }
-                if (t.isIdentifier(callee)) {
-                    const funcName = callee.name;
-                    if (['eval', 'Function', 'setTimeout', 'setInterval'].includes(funcName)) {
-                        const sinkId = `sink-eval-${line}`;
-                        sinks.push({ type: 'eval', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: `${funcName}()`,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        checkTaintedArguments(path.node.arguments, taintMap, taintPaths, funcName, line);
-                    }
-                }
-                if (t.isMemberExpression(callee) && t.isIdentifier(callee.property)) {
-                    const methodName = callee.property.name;
-                    if (['write', 'writeln'].includes(methodName) &&
-                        t.isIdentifier(callee.object) &&
-                        callee.object.name === 'document') {
-                        const sinkId = `sink-document-write-${line}`;
-                        sinks.push({ type: 'xss', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: `document.${methodName}()`,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        checkTaintedArguments(path.node.arguments, taintMap, taintPaths, methodName, line);
-                    }
-                    if (['query', 'execute', 'exec', 'run'].includes(methodName)) {
-                        const sinkId = `sink-sql-${line}`;
-                        sinks.push({ type: 'sql-injection', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: `${methodName}() (SQL)`,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        checkTaintedArguments(path.node.arguments, taintMap, taintPaths, methodName, line);
-                    }
-                    if (['exec', 'spawn', 'execSync', 'spawnSync'].includes(methodName)) {
-                        const sinkId = `sink-command-${line}`;
-                        sinks.push({ type: 'other', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: `${methodName}() (Command)`,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        checkTaintedArguments(path.node.arguments, taintMap, taintPaths, methodName, line);
-                    }
-                    if (['readFile', 'writeFile', 'readFileSync', 'writeFileSync', 'open'].includes(methodName)) {
-                        const sinkId = `sink-file-${line}`;
-                        sinks.push({ type: 'other', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: `${methodName}() (File)`,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        checkTaintedArguments(path.node.arguments, taintMap, taintPaths, methodName, line);
-                    }
-                }
-            },
-            MemberExpression(path) {
-                const obj = path.node.object;
-                const prop = path.node.property;
-                const line = path.node.loc?.start.line || 0;
-                if (t.isIdentifier(obj) && obj.name === 'location' && t.isIdentifier(prop)) {
-                    if (['href', 'search', 'hash', 'pathname'].includes(prop.name)) {
-                        const sourceId = `source-url-${line}`;
-                        sources.push({ type: 'user_input', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sourceId,
-                            name: `location.${prop.name}`,
-                            type: 'source',
-                            location: { file: 'current', line },
-                        });
-                        const parent = path.parent;
-                        if (t.isVariableDeclarator(parent) && t.isIdentifier(parent.id)) {
-                            taintMap.set(parent.id.name, { sourceType: 'url', sourceLine: line });
-                        }
-                    }
-                }
-                if (t.isIdentifier(obj) &&
-                    obj.name === 'document' &&
-                    t.isIdentifier(prop) &&
-                    prop.name === 'cookie') {
-                    const sourceId = `source-cookie-${line}`;
-                    sources.push({ type: 'storage', location: { file: 'current', line } });
-                    graph.nodes.push({
-                        id: sourceId,
-                        name: 'document.cookie',
-                        type: 'source',
-                        location: { file: 'current', line },
-                    });
-                }
-                if (t.isIdentifier(obj) && ['localStorage', 'sessionStorage'].includes(obj.name)) {
-                    const sourceId = `source-storage-${line}`;
-                    sources.push({ type: 'storage', location: { file: 'current', line } });
-                    graph.nodes.push({
-                        id: sourceId,
-                        name: `${obj.name}.getItem()`,
-                        type: 'source',
-                        location: { file: 'current', line },
-                    });
-                }
-                if (t.isIdentifier(obj) &&
-                    obj.name === 'window' &&
-                    t.isIdentifier(prop) &&
-                    prop.name === 'name') {
-                    const sourceId = `source-window-name-${line}`;
-                    sources.push({ type: 'user_input', location: { file: 'current', line } });
-                    graph.nodes.push({
-                        id: sourceId,
-                        name: 'window.name',
-                        type: 'source',
-                        location: { file: 'current', line },
-                    });
-                }
-                if (t.isIdentifier(obj) &&
-                    obj.name === 'event' &&
-                    t.isIdentifier(prop) &&
-                    prop.name === 'data') {
-                    const sourceId = `source-postmessage-${line}`;
-                    sources.push({ type: 'network', location: { file: 'current', line } });
-                    graph.nodes.push({
-                        id: sourceId,
-                        name: 'event.data (postMessage)',
-                        type: 'source',
-                        location: { file: 'current', line },
-                    });
-                }
-                if (t.isIdentifier(obj) &&
-                    obj.name === 'message' &&
-                    t.isIdentifier(prop) &&
-                    prop.name === 'data') {
-                    const sourceId = `source-websocket-${line}`;
-                    sources.push({ type: 'network', location: { file: 'current', line } });
-                    graph.nodes.push({
-                        id: sourceId,
-                        name: 'WebSocket message.data',
-                        type: 'source',
-                        location: { file: 'current', line },
-                    });
-                }
-            },
-            AssignmentExpression(path) {
-                const left = path.node.left;
-                const right = path.node.right;
-                const line = path.node.loc?.start.line || 0;
-                if (t.isMemberExpression(left) && t.isIdentifier(left.property)) {
-                    const propName = left.property.name;
-                    if (['innerHTML', 'outerHTML'].includes(propName)) {
-                        const sinkId = `sink-dom-${line}`;
-                        sinks.push({ type: 'xss', location: { file: 'current', line } });
-                        graph.nodes.push({
-                            id: sinkId,
-                            name: propName,
-                            type: 'sink',
-                            location: { file: 'current', line },
-                        });
-                        if (t.isIdentifier(right) && taintMap.has(right.name)) {
-                            const taintInfo = taintMap.get(right.name);
-                            taintPaths.push({
-                                source: {
-                                    type: taintInfo.sourceType,
-                                    location: { file: 'current', line: taintInfo.sourceLine },
-                                },
-                                sink: { type: 'xss', location: { file: 'current', line } },
-                                path: [
-                                    { file: 'current', line: taintInfo.sourceLine },
-                                    { file: 'current', line },
-                                ],
-                            });
-                        }
-                    }
-                }
-            },
-        });
-        traverse(ast, {
-            VariableDeclarator(path) {
-                const id = path.node.id;
-                const init = path.node.init;
-                if (t.isIdentifier(id) && init) {
-                    if (t.isCallExpression(init) && checkSanitizer(init, sanitizers)) {
-                        const arg = init.arguments[0];
-                        if (t.isIdentifier(arg) && taintMap.has(arg.name)) {
-                            logger.debug(`Taint cleaned by sanitizer: ${arg.name} -> ${id.name}`);
-                            return;
-                        }
-                    }
-                    if (t.isIdentifier(init) && taintMap.has(init.name)) {
-                        const taintInfo = taintMap.get(init.name);
-                        taintMap.set(id.name, taintInfo);
-                    }
-                    else if (t.isBinaryExpression(init)) {
-                        const leftTainted = t.isIdentifier(init.left) && taintMap.has(init.left.name);
-                        const rightTainted = t.isIdentifier(init.right) && taintMap.has(init.right.name);
-                        if (leftTainted || rightTainted) {
-                            const taintInfo = leftTainted
-                                ? taintMap.get(init.left.name)
-                                : taintMap.get(init.right.name);
-                            taintMap.set(id.name, taintInfo);
-                        }
-                    }
-                    else if (t.isCallExpression(init)) {
-                        const arg = init.arguments[0];
-                        if (t.isIdentifier(arg) && taintMap.has(arg.name)) {
-                            const taintInfo = taintMap.get(arg.name);
-                            taintMap.set(id.name, taintInfo);
-                        }
-                    }
-                }
-            },
-            AssignmentExpression(path) {
-                const left = path.node.left;
-                const right = path.node.right;
-                if (t.isIdentifier(left) && t.isIdentifier(right) && taintMap.has(right.name)) {
-                    const taintInfo = taintMap.get(right.name);
-                    taintMap.set(left.name, taintInfo);
-                }
-            },
-        });
-    }
-    catch (error) {
-        logger.warn('Data flow analysis failed', error);
-    }
-    return {
-        graph,
-        sources,
-        sinks,
-        taintPaths,
-    };
-}
-function checkTaintedArguments(args, taintMap, taintPaths, _funcName, line) {
-    args.forEach((arg) => {
-        if (t.isIdentifier(arg) && taintMap.has(arg.name)) {
-            const taintInfo = taintMap.get(arg.name);
-            taintPaths.push({
-                source: {
-                    type: taintInfo.sourceType,
-                    location: { file: 'current', line: taintInfo.sourceLine },
-                },
-                sink: {
-                    type: 'eval',
-                    location: { file: 'current', line },
-                },
-                path: [
-                    { file: 'current', line: taintInfo.sourceLine },
-                    { file: 'current', line },
-                ],
-            });
-        }
-    });
-}

package/dist/src/modules/analyzer/IntelligentAnalyzer.d.ts

@@ -1,62 +0,0 @@
-import type { NetworkRequest, NetworkResponse } from '../monitor/ConsoleMonitor.js';
-import type { ConsoleMessage, ExceptionInfo } from '../monitor/ConsoleMonitor.js';
-export interface AnalysisResult {
-    criticalRequests: NetworkRequest[];
-    criticalResponses: NetworkResponse[];
-    criticalLogs: ConsoleMessage[];
-    exceptions: ExceptionInfo[];
-    patterns: {
-        encryption?: EncryptionPattern[];
-        signature?: SignaturePattern[];
-        token?: TokenPattern[];
-        antiDebug?: AntiDebugPattern[];
-    };
-    summary: {
-        totalRequests: number;
-        filteredRequests: number;
-        totalLogs: number;
-        filteredLogs: number;
-        suspiciousAPIs: string[];
-        keyFunctions: string[];
-    };
-}
-export interface EncryptionPattern {
-    type: 'AES' | 'RSA' | 'MD5' | 'SHA' | 'Base64' | 'Custom';
-    location: string;
-    confidence: number;
-    evidence: string[];
-}
-export interface SignaturePattern {
-    type: 'HMAC' | 'JWT' | 'Custom';
-    location: string;
-    parameters: string[];
-    confidence: number;
-}
-export interface TokenPattern {
-    type: 'OAuth' | 'JWT' | 'Custom';
-    location: string;
-    format: string;
-    confidence: number;
-}
-export interface AntiDebugPattern {
-    type: 'debugger' | 'console.log' | 'devtools-detect' | 'timing-check';
-    location: string;
-    code: string;
-}
-export declare class IntelligentAnalyzer {
-    constructor(legacyDependency?: unknown);
-    analyze(data: {
-        requests: NetworkRequest[];
-        responses: NetworkResponse[];
-        logs: ConsoleMessage[];
-        exceptions: ExceptionInfo[];
-    }): AnalysisResult;
-    aggregateSimilarRequests(requests: NetworkRequest[]): Map<string, NetworkRequest[]>;
-    generateAIFriendlySummary(result: AnalysisResult): string;
-    analyzeWithLLM(data: {
-        requests: NetworkRequest[];
-        responses: NetworkResponse[];
-        logs: ConsoleMessage[];
-        exceptions: ExceptionInfo[];
-    }): Promise<AnalysisResult>;
-}

package/dist/src/modules/analyzer/IntelligentAnalyzer.js

@@ -1,124 +0,0 @@
-import { logger } from '../../utils/logger.js';
-import { filterCriticalRequests, filterCriticalResponses, filterCriticalLogs, detectEncryptionPatterns, detectSignaturePatterns, detectTokenPatterns, detectAntiDebugPatterns, extractSuspiciousAPIs, extractKeyFunctions, } from '../analyzer/PatternDetector.js';
-export class IntelligentAnalyzer {
-    constructor(legacyDependency) {
-        void legacyDependency;
-    }
-    analyze(data) {
-        logger.info('Starting intelligent analysis...', {
-            requests: data.requests.length,
-            responses: data.responses.length,
-            logs: data.logs.length,
-            exceptions: data.exceptions.length,
-        });
-        const criticalRequests = filterCriticalRequests(data.requests);
-        const criticalResponses = filterCriticalResponses(data.responses);
-        const criticalLogs = filterCriticalLogs(data.logs);
-        const patterns = {
-            encryption: detectEncryptionPatterns(data.requests, data.logs),
-            signature: detectSignaturePatterns(data.requests, data.logs),
-            token: detectTokenPatterns(data.requests, data.logs),
-            antiDebug: detectAntiDebugPatterns(data.logs),
-        };
-        const suspiciousAPIs = extractSuspiciousAPIs(criticalRequests);
-        const keyFunctions = extractKeyFunctions(criticalLogs);
-        const result = {
-            criticalRequests,
-            criticalResponses,
-            criticalLogs,
-            exceptions: data.exceptions,
-            patterns,
-            summary: {
-                totalRequests: data.requests.length,
-                filteredRequests: criticalRequests.length,
-                totalLogs: data.logs.length,
-                filteredLogs: criticalLogs.length,
-                suspiciousAPIs,
-                keyFunctions,
-            },
-        };
-        logger.success('Analysis completed', {
-            criticalRequests: criticalRequests.length,
-            criticalLogs: criticalLogs.length,
-            patterns: Object.keys(patterns).length,
-        });
-        return result;
-    }
-    aggregateSimilarRequests(requests) {
-        const groups = new Map();
-        for (const req of requests) {
-            try {
-                const url = new URL(req.url);
-                const baseUrl = `${url.origin}${url.pathname}`;
-                if (!groups.has(baseUrl)) {
-                    groups.set(baseUrl, []);
-                }
-                groups.get(baseUrl).push(req);
-            }
-            catch {
-            }
-        }
-        return groups;
-    }
-    generateAIFriendlySummary(result) {
-        const lines = [];
-        lines.push('=== Analysis Summary ===');
-        lines.push('');
-        lines.push(`Statistics:`);
-        lines.push(`  - Requests: ${result.summary.totalRequests} -> Filtered: ${result.summary.filteredRequests}`);
-        lines.push(`  - Logs: ${result.summary.totalLogs} -> Filtered: ${result.summary.filteredLogs}`);
-        lines.push(`  - Exceptions: ${result.exceptions.length}`);
-        lines.push('');
-        if (result.summary.suspiciousAPIs.length > 0) {
-            lines.push(`Suspicious APIs (${result.summary.suspiciousAPIs.length}):`);
-            result.summary.suspiciousAPIs.slice(0, 10).forEach((api) => {
-                lines.push(`  - ${api}`);
-            });
-            lines.push('');
-        }
-        if (result.patterns.encryption && result.patterns.encryption.length > 0) {
-            lines.push(`Encryption Patterns (${result.patterns.encryption.length}):`);
-            result.patterns.encryption.slice(0, 5).forEach((pattern) => {
-                const evidence = Array.isArray(pattern.evidence)
-                    ? pattern.evidence.join(', ')
-                    : pattern.evidence
-                        ? String(pattern.evidence)
-                        : '';
-                lines.push(`  - ${pattern.type} (confidence: ${(pattern.confidence * 100).toFixed(0)}%)`);
-                lines.push(`    location: ${pattern.location}`);
-                lines.push(`    evidence: ${evidence}`);
-            });
-            lines.push('');
-        }
-        if (result.patterns.signature && result.patterns.signature.length > 0) {
-            lines.push(`Signature Patterns (${result.patterns.signature.length}):`);
-            result.patterns.signature.slice(0, 5).forEach((pattern) => {
-                const parameters = Array.isArray(pattern.parameters)
-                    ? pattern.parameters.join(', ')
-                    : pattern.parameters
-                        ? String(pattern.parameters)
-                        : '';
-                lines.push(`  - ${pattern.type}`);
-                lines.push(`    parameters: ${parameters}`);
-            });
-            lines.push('');
-        }
-        if (result.patterns.antiDebug && result.patterns.antiDebug.length > 0) {
-            lines.push(`Anti-Debug Patterns (${result.patterns.antiDebug.length}):`);
-            result.patterns.antiDebug.slice(0, 3).forEach((pattern) => {
-                lines.push(`  - ${pattern.type}`);
-            });
-            lines.push('');
-        }
-        if (result.summary.keyFunctions.length > 0) {
-            lines.push(`Key Functions (${result.summary.keyFunctions.length}):`);
-            lines.push(`  ${result.summary.keyFunctions.slice(0, 15).join(', ')}`);
-            lines.push('');
-        }
-        lines.push('=== Analysis Summary ===');
-        return lines.join('\n');
-    }
-    async analyzeWithLLM(data) {
-        return this.analyze(data);
-    }
-}

package/dist/src/modules/analyzer/PatternDetector.d.ts

@@ -1,21 +0,0 @@
-import type { NetworkRequest, NetworkResponse } from '../monitor/ConsoleMonitor.js';
-import type { ConsoleMessage } from '../monitor/ConsoleMonitor.js';
-import type { EncryptionPattern, SignaturePattern, TokenPattern, AntiDebugPattern } from '../analyzer/IntelligentAnalyzer.js';
-export declare const BLACKLIST_DOMAINS: string[];
-export declare const WHITELIST_KEYWORDS: string[];
-export declare const FRAMEWORK_LOG_KEYWORDS: string[];
-export declare function calculateRequestPriority(req: NetworkRequest): number;
-export declare function filterCriticalRequests(requests: NetworkRequest[]): NetworkRequest[];
-export declare function filterCriticalResponses(responses: NetworkResponse[]): NetworkResponse[];
-export declare function calculateLogPriority(log: ConsoleMessage): number;
-export declare function filterCriticalLogs(logs: ConsoleMessage[]): ConsoleMessage[];
-export declare function deduplicatePatterns<T extends {
-    location: string;
-    type: string;
-}>(patterns: T[]): T[];
-export declare function detectEncryptionPatterns(requests: NetworkRequest[], logs: ConsoleMessage[]): EncryptionPattern[];
-export declare function detectSignaturePatterns(requests: NetworkRequest[], _logs: ConsoleMessage[]): SignaturePattern[];
-export declare function detectTokenPatterns(requests: NetworkRequest[], _logs: ConsoleMessage[]): TokenPattern[];
-export declare function detectAntiDebugPatterns(logs: ConsoleMessage[]): AntiDebugPattern[];
-export declare function extractSuspiciousAPIs(requests: NetworkRequest[]): string[];
-export declare function extractKeyFunctions(logs: ConsoleMessage[]): string[];