@keithadler/frostjs 0.1.0 → 0.3.0

package/dist/extract/recognizers/device.d.ts

@@ -0,0 +1,10 @@
+import { type Recognizer } from "./types.js";
+/**
+ * Reaching the machine, not just the page: WebUSB, Web Bluetooth, Web
+ * Serial, WebHID, Web MIDI and the wake lock through `navigator`; the File
+ * System Access pickers, which hand back a real file or directory handle;
+ * and `Notification`. These are strong capabilities a page rarely needs and
+ * a policy will almost always want to deny by default.
+ */
+export declare const device: Recognizer;
+//# sourceMappingURL=device.d.ts.map

package/dist/extract/recognizers/device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/device.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAgB3D;;;;;;GAMG;AACH,eAAO,MAAM,MAAM,EAAE,UAsBpB,CAAC"}

package/dist/extract/recognizers/device.js

@@ -0,0 +1,46 @@
+import { match } from "./types.js";
+import { asGlobalIn, asNamedGlobal, isIdentifier, memberName } from "./resolve.js";
+/** navigator members that reach hardware or the user's device beyond fingerprinting. */
+const NAVIGATOR = new Map([
+    ["usb", "device.usb"],
+    ["bluetooth", "device.bluetooth"],
+    ["serial", "device.serial"],
+    ["hid", "device.hid"],
+    ["wakeLock", "device.wakelock"],
+    ["requestMIDIAccess", "device.midi"],
+]);
+/** Bare/window globals that open the File System Access picker: read or write the user's real files. */
+const FILE_PICKERS = new Set(["showOpenFilePicker", "showSaveFilePicker", "showDirectoryPicker"]);
+/**
+ * Reaching the machine, not just the page: WebUSB, Web Bluetooth, Web
+ * Serial, WebHID, Web MIDI and the wake lock through `navigator`; the File
+ * System Access pickers, which hand back a real file or directory handle;
+ * and `Notification`. These are strong capabilities a page rarely needs and
+ * a policy will almost always want to deny by default.
+ */
+export const device = ({ node, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    // showOpenFilePicker(...), window.showSaveFilePicker(...)
+    const picker = asGlobalIn(n, FILE_PICKERS);
+    if (picker)
+        return match("device.filesystem", picker.r, node);
+    // Notification: new Notification(...), Notification.requestPermission(), Notification.permission
+    if (isIdentifier(n, "Notification"))
+        return { capability: "device.notification", target: null, confidence: "certain", via: n, node };
+    if (n.type === "MemberExpression" && memberName(n) === "Notification") {
+        const r = asNamedGlobal(n["object"], "window");
+        if (r)
+            return match("device.notification", r, node);
+    }
+    // navigator.usb, navigator.bluetooth, navigator.requestMIDIAccess, ...
+    if (n.type !== "MemberExpression")
+        return null;
+    const cap = NAVIGATOR.get(memberName(n) ?? "");
+    if (!cap)
+        return null;
+    const r = asNamedGlobal(n["object"], "navigator");
+    return r ? match(cap, r, node) : null;
+};
+//# sourceMappingURL=device.js.map

package/dist/extract/recognizers/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../../src/extract/recognizers/device.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAA0B,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEnF,wFAAwF;AACxF,MAAM,SAAS,GAAgC,IAAI,GAAG,CAAC;IACrD,CAAC,KAAK,EAAE,YAAY,CAAC;IACrB,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACjC,CAAC,QAAQ,EAAE,eAAe,CAAC;IAC3B,CAAC,KAAK,EAAE,YAAY,CAAC;IACrB,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAC/B,CAAC,mBAAmB,EAAE,aAAa,CAAC;CACrC,CAAC,CAAC;AAEH,wGAAwG;AACxG,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEvH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,MAAM,GAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;IACtD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAE1B,0DAA0D;IAC1D,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAE9D,iGAAiG;IACjG,IAAI,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IAClG,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,qBAAqB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,uEAAuE;IACvE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC,CAAC"}

package/dist/extract/recognizers/dom-escape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dom-escape.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAelF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,UAmCvB,CAAC"}
+{"version":3,"file":"dom-escape.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAkBlF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,UA0CvB,CAAC"}

package/dist/extract/recognizers/dom-escape.js

@@ -4,6 +4,8 @@ import { asNamedGlobal, memberName } from "./resolve.js";
 const HTML_SINKS = new Set(["innerHTML", "outerHTML", "srcdoc"]);
 /** Methods whose call parses HTML. */
 const HTML_METHODS = new Set(["insertAdjacentHTML", "createContextualFragment"]);
+/** Attribute names whose value is HTML or code: setAttribute("srcdoc"/"onclick", ...) is a sink. */
+const isCodeAttribute = (name) => name === "srcdoc" || /^on[a-z]+$/.test(name);
 /** Intrinsic JSX elements, and createElement tag names, that run code. */
 const CODE_ELEMENTS = new Map([
     ["script", "dom-escape.script"],
@@ -48,6 +50,15 @@ export const domEscape = ({ node, ancestors, binding }) => {
         return null;
     if (HTML_METHODS.has(prop))
         return plain("dom-escape.html", node);
+    // setAttribute("srcdoc", html) parses HTML; setAttribute("onclick", code) installs a handler from a string.
+    if (prop === "setAttribute") {
+        const attr = stringValue(args[0])?.toLowerCase();
+        if (attr === "srcdoc")
+            return plain("dom-escape.html", node);
+        if (attr !== undefined && isCodeAttribute(attr))
+            return plain("dom-escape.handler", node);
+        return null;
+    }
     if (prop === "createElement") {
         const r = asNamedGlobal(n["object"], "document");
         const cap = r ? CODE_ELEMENTS.get(stringValue(args[0])?.toLowerCase() ?? "") : undefined;

package/dist/extract/recognizers/dom-escape.js.map

@@ -1 +1 @@
-{"version":3,"file":"dom-escape.js","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzD,+CAA+C;AAC/C,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtF,sCAAsC;AACtC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEtG,0EAA0E;AAC1E,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAC/B,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACpE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAE1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,OAAO,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"dom-escape.js","sourceRoot":"","sources":["../../../src/extract/recognizers/dom-escape.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAmB,MAAM,YAAY,CAAC;AAClF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEzD,+CAA+C;AAC/C,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtF,sCAAsC;AACtC,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,0BAA0B,CAAC,CAAC,CAAC;AAEtG,oGAAoG;AACpG,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEhG,0EAA0E;AAC1E,MAAM,aAAa,GAAgC,IAAI,GAAG,CAAC;IACzD,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IAC/B,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IACpE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAE1B,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAE,IAAI,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,OAAO,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAY,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;QACnF,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAClE,4GAA4G;IAC5G,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,UAAU,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/extract/recognizers/message.d.ts

@@ -0,0 +1,16 @@
+import { type Recognizer } from "./types.js";
+/**
+ * A main-thread `message` listener that reads the message but never checks
+ * its origin. `window.addEventListener("message", handler)` receives
+ * messages from any frame or window; a handler that uses `event.data`
+ * without comparing `event.origin` is the classic postMessage-XSS shape.
+ * This is a heuristic: it fires when the handler references the event's
+ * `data` and nowhere references its `origin`. `window.onmessage = handler`
+ * is covered too.
+ *
+ * Only `window` counts, not `self`/`globalThis`: `self.onmessage` is the
+ * worker idiom, and a worker's messages come from its own creator, so an
+ * origin check does not apply there.
+ */
+export declare const message: Recognizer;
+//# sourceMappingURL=message.d.ts.map

package/dist/extract/recognizers/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/message.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAM9D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,OAAO,EAAE,UA0BrB,CAAC"}

package/dist/extract/recognizers/message.js

@@ -0,0 +1,92 @@
+import { callArgs, plain } from "./types.js";
+import { isIdentifier, memberName } from "./resolve.js";
+import { FREE } from "../annotations.js";
+/**
+ * A main-thread `message` listener that reads the message but never checks
+ * its origin. `window.addEventListener("message", handler)` receives
+ * messages from any frame or window; a handler that uses `event.data`
+ * without comparing `event.origin` is the classic postMessage-XSS shape.
+ * This is a heuristic: it fires when the handler references the event's
+ * `data` and nowhere references its `origin`. `window.onmessage = handler`
+ * is covered too.
+ *
+ * Only `window` counts, not `self`/`globalThis`: `self.onmessage` is the
+ * worker idiom, and a worker's messages come from its own creator, so an
+ * origin check does not apply there.
+ */
+export const message = ({ node, ancestors, binding }) => {
+    if (binding)
+        return null;
+    const n = node;
+    const parent = ancestors[0];
+    if (n.type !== "MemberExpression" || !isWindow(n["object"]))
+        return null;
+    let handler;
+    // window.addEventListener("message", handler)
+    if (memberName(n) === "addEventListener") {
+        const args = callArgs(node, parent);
+        if (args && stringLit(args[0]) === "message")
+            handler = args[1];
+    }
+    // window.onmessage = handler
+    if (memberName(n) === "onmessage" && parent?.type === "AssignmentExpression" && parent["left"] === node) {
+        handler = parent["right"];
+    }
+    if (handler === undefined)
+        return null;
+    const param = firstParamName(handler);
+    if (param === null)
+        return null; // no named event parameter to reason about
+    const body = handler["body"];
+    if (!body)
+        return null;
+    const readsData = referencesMember(body, param, "data");
+    const checksOrigin = referencesMember(body, param, "origin");
+    if (readsData && !checksOrigin)
+        return plain("navigation.message-receive", n);
+    return null;
+};
+/** True for a free reference to the `window` global. */
+function isWindow(nd) {
+    return isIdentifier(nd, "window") && nd[FREE] === true;
+}
+function stringLit(nd) {
+    return nd?.type === "Literal" && typeof nd["value"] === "string" ? nd["value"] : null;
+}
+/** The first parameter's identifier name of a function/arrow, or null if it is not a plain name. */
+function firstParamName(fn) {
+    const params = fn["params"];
+    const p = params?.[0];
+    return p?.type === "Identifier" ? p["name"] : null;
+}
+/** Does the subtree contain `<param>.<prop>` (or `<param>["<prop>"]`)? A shallow, allocation-free walk. */
+function referencesMember(root, param, prop) {
+    let found = false;
+    const visit = (nd) => {
+        if (found)
+            return;
+        if (nd.type === "MemberExpression") {
+            const obj = nd["object"];
+            if (isIdentifier(obj, param) && memberName(nd) === prop) {
+                found = true;
+                return;
+            }
+        }
+        for (const key of Object.keys(nd)) {
+            if (key === "type" || key === "start" || key === "end")
+                continue;
+            const v = nd[key];
+            if (Array.isArray(v)) {
+                for (const item of v)
+                    if (item && typeof item === "object" && typeof item.type === "string")
+                        visit(item);
+            }
+            else if (v && typeof v === "object" && typeof v.type === "string") {
+                visit(v);
+            }
+        }
+    };
+    visit(root);
+    return found;
+}
+//# sourceMappingURL=message.js.map

package/dist/extract/recognizers/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../../src/extract/recognizers/message.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAIzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAY,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAqB,CAAC;IAEhD,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACjF,IAAI,OAAyB,CAAC;IAC9B,8CAA8C;IAC9C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,6BAA6B;IAC7B,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,MAAM,EAAE,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACxG,OAAO,GAAG,MAAM,CAAC,OAAO,CAAS,CAAC;IACpC,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEvC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAqB,CAAC;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7D,IAAI,SAAS,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,wDAAwD;AACxD,SAAS,QAAQ,CAAC,EAAQ;IACxB,OAAO,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AACzD,CAAC;AAED,SAAS,SAAS,CAAC,EAAoB;IACrC,OAAO,EAAE,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxF,CAAC;AAED,oGAAoG;AACpG,SAAS,cAAc,CAAC,EAAQ;IAC9B,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAuB,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,IAAU,EAAE,KAAa,EAAE,IAAY;IAC/D,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,EAAQ,EAAQ,EAAE;QAC/B,IAAI,KAAK;YAAE,OAAO;QAClB,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAS,CAAC;YACjC,IAAI,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxD,KAAK,GAAG,IAAI,CAAC;gBACb,OAAO;YACT,CAAC;QACH,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;gBAAE,SAAS;YACjE,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,CAAC;oBAClB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAQ,IAAa,CAAC,IAAI,KAAK,QAAQ;wBAAE,KAAK,CAAC,IAAY,CAAC,CAAC;YACzG,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9E,KAAK,CAAC,CAAS,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC;IACZ,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/extract/recognizers/network.d.ts

@@ -1,11 +1,19 @@
 import { type Recognizer } from "./types.js";
 /**
  * Ways code reaches another host: fetch, XMLHttpRequest, WebSocket,
- * EventSource, navigator.sendBeacon, and dynamic import() of an absolute
- * URL or an expression whose destination cannot be fixed. import() of a
+ * EventSource, navigator.sendBeacon, importScripts() (which loads and runs
+ * a script in a worker), and dynamic import() of an absolute URL or an
+ * expression whose destination cannot be fixed. import() of a
  * relative path (code splitting) or a bare specifier ("lodash", "node:fs")
  * resolves through the bundler or import map, not the network, and is not
  * reported.
+ *
+ * Also `network.resource`: an element's `src` set to another host
+ * (`script.src = "https://cdn..."`, `setAttribute("src", ...)`), when the
+ * URL is a literal or a folded const. The element is not checked; what
+ * matters is the host. A value that cannot be read is not reported: `.src`
+ * is set on tokens and props as often as on elements, and a list of
+ * "unknown" lines nobody can act on is noise.
  */
 export declare const network: Recognizer;
 //# sourceMappingURL=network.d.ts.map

package/dist/extract/recognizers/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAarE;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,EAAE,UAoBrB,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAcrE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,OAAO,EAAE,UAkDrB,CAAC"}

package/dist/extract/recognizers/network.js

@@ -1,6 +1,6 @@
 import { callArgs, match, plain } from "./types.js";
-import { asGlobalIn, asNamedGlobal, memberName } from "./resolve.js";
-import { resolveTargetOf } from "../target.js";
+import { asGlobalIn, asGlobalObject, asNamedGlobal, isIdentifier, memberName } from "./resolve.js";
+import { resolveTargetOf, SAME_ORIGIN } from "../target.js";
 /** Globals that are network entry points. The target comes from the first call argument. */
 const NETWORK_GLOBALS = new Map([
     ["fetch", "network.fetch"],
@@ -9,13 +9,22 @@ const NETWORK_GLOBALS = new Map([
     ["EventSource", "network.eventsource"],
 ]);
 const NETWORK_NAMES = new Set(NETWORK_GLOBALS.keys());
+const IMPORT_SCRIPTS = "importScripts";
 /**
  * Ways code reaches another host: fetch, XMLHttpRequest, WebSocket,
- * EventSource, navigator.sendBeacon, and dynamic import() of an absolute
- * URL or an expression whose destination cannot be fixed. import() of a
+ * EventSource, navigator.sendBeacon, importScripts() (which loads and runs
+ * a script in a worker), and dynamic import() of an absolute URL or an
+ * expression whose destination cannot be fixed. import() of a
  * relative path (code splitting) or a bare specifier ("lodash", "node:fs")
  * resolves through the bundler or import map, not the network, and is not
  * reported.
+ *
+ * Also `network.resource`: an element's `src` set to another host
+ * (`script.src = "https://cdn..."`, `setAttribute("src", ...)`), when the
+ * URL is a literal or a folded const. The element is not checked; what
+ * matters is the host. A value that cannot be read is not reported: `.src`
+ * is set on tokens and props as often as on elements, and a list of
+ * "unknown" lines nobody can act on is noise.
  */
 export const network = ({ node, ancestors, binding }) => {
     if (binding)
@@ -32,10 +41,44 @@ export const network = ({ node, ancestors, binding }) => {
     const g = asGlobalIn(n, NETWORK_NAMES);
     if (g)
         return match(NETWORK_GLOBALS.get(g.name), g.r, node, firstArg());
-    if (n.type === "MemberExpression" && memberName(n) === "sendBeacon") {
+    // importScripts("https://...") / self.importScripts(...): loads and runs a script in a worker.
+    if (callArgs(node, parent)) {
+        if (isIdentifier(n, IMPORT_SCRIPTS)) {
+            return { capability: "network.importscripts", target: firstArg(), confidence: "certain", via: n, node };
+        }
+        if (n.type === "MemberExpression" && memberName(n) === IMPORT_SCRIPTS) {
+            const r = asGlobalObject(n["object"]);
+            if (r)
+                return match("network.importscripts", r, node, firstArg());
+        }
+    }
+    if (n.type !== "MemberExpression")
+        return null;
+    const prop = memberName(n);
+    if (prop === "sendBeacon") {
         const r = asNamedGlobal(n["object"], "navigator");
         return r ? match("network.beacon", r, node, firstArg()) : null;
     }
-    return null;
+    // el.src = url; el.setAttribute("src", url)
+    let value;
+    let anchor = n;
+    if (prop === "src" && parent?.type === "AssignmentExpression" && parent["left"] === node) {
+        value = parent["right"];
+        anchor = parent;
+    }
+    else if (prop === "setAttribute") {
+        const args = callArgs(node, parent);
+        if (args && args[0]?.type === "Literal" && args[0]["value"] === "src")
+            value = args[1];
+    }
+    if (value === undefined)
+        return null;
+    // URL.createObjectURL(...) is a blob by construction.
+    if (value.type === "CallExpression" && memberName(value["callee"]) === "createObjectURL")
+        return null;
+    const target = resolveTargetOf(value);
+    if (target === null || target === SAME_ORIGIN || target === "bare" || target === "data:" || target === "blob:")
+        return null;
+    return { capability: "network.resource", target, confidence: "certain", via: null, node: anchor };
 };
 //# sourceMappingURL=network.js.map

package/dist/extract/recognizers/network.js.map

@@ -1 +1 @@
-{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,4FAA4F;AAC5F,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,CAAC,OAAO,EAAE,eAAe,CAAC;IAC1B,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACjC,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAClC,CAAC,aAAa,EAAE,qBAAqB,CAAC;CACvC,CAAC,CAAC;AACH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzE,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,YAAY,EAAE,CAAC;QACpE,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../../src/extract/recognizers/network.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE5D,4FAA4F;AAC5F,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAC3D,CAAC,OAAO,EAAE,eAAe,CAAC;IAC1B,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACjC,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAClC,CAAC,aAAa,EAAE,qBAAqB,CAAC;CACvC,CAAC,CAAC;AACH,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3E,MAAM,cAAc,GAAG,eAAe,CAAC;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,OAAO,GAAe,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;IAClE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,CAAC,GAAG,IAAe,CAAC;IAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAwB,CAAC;IACnD,MAAM,QAAQ,GAAG,GAAkB,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzF,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QACpE,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAC/D,OAAO,KAAK,CAAC,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACvC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEzE,+FAA+F;IAC/F,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAI,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QAC1G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAY,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,uBAAuB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAY,EAAE,WAAW,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,4CAA4C;IAC5C,IAAI,KAA0B,CAAC;IAC/B,IAAI,MAAM,GAAY,CAAC,CAAC;IACxB,IAAI,IAAI,KAAK,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACzF,KAAK,GAAG,MAAM,CAAC,OAAO,CAAY,CAAC;QACnC,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;SAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,sDAAsD;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACjH,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,OAAO;QAC5G,OAAO,IAAI,CAAC;IACd,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpG,CAAC,CAAC"}

package/dist/extract/taint.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Bounded taint analysis: does untrusted input reach a dangerous sink?
+ *
+ * frostjs's recognizers say "this file can eval" or "this file reaches
+ * host X". Taint answers the harder question: does a value that came from
+ * an attacker-influenced source (a URL parameter, document.cookie, a
+ * postMessage payload) actually flow into eval, innerHTML, importScripts,
+ * a redirect, and so on. That is the difference between a capability and a
+ * vulnerability, and it is what the three.js/ECSY finding was underneath:
+ * `location.search` gated a path that eval'd relay data.
+ *
+ * The one rule that keeps this from crying wolf: **taint survives only
+ * through operations that provably preserve it** - string methods, URL
+ * decoding, JSON.parse, template concatenation, member access. Any other
+ * function call breaks the chain, so `el.innerHTML = DOMPurify.sanitize(x)`
+ * is not flagged while `el.innerHTML = x` is. Flow is followed within a
+ * function (with closure inheritance and message-handler seeding) and one
+ * hop across a call: a tainted argument to a local function whose parameter
+ * reaches a sink. A whole call graph is not walked, and that is stated as a
+ * limit rather than hidden.
+ */
+import { type ParsedFile } from "./ast.js";
+export interface TaintFinding {
+    /** Where the value came from, e.g. "location.hash", "document.cookie", "postMessage data". */
+    source: string;
+    /** What it reached, e.g. "eval", "innerHTML", "importScripts". */
+    sink: string;
+    file: string;
+    line: number;
+    column: number;
+    /** Source text of the sink expression. */
+    expression: string;
+}
+/** Find every untrusted-source-to-dangerous-sink flow in the file. */
+export declare function taint(parsed: ParsedFile): TaintFinding[];
+//# sourceMappingURL=taint.d.ts.map

package/dist/extract/taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.d.ts","sourceRoot":"","sources":["../../src/extract/taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAKhF,MAAM,WAAW,YAAY;IAC3B,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AA4bD,sEAAsE;AACtE,wBAAgB,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,EAAE,CAkBxD"}