@nodesecure/js-x-ray 6.1.1 → 6.2.1

package/README.md

@@ -7,7 +7,7 @@
       <img src="https://img.shields.io/badge/dynamic/json.svg?style=for-the-badge&url=https://raw.githubusercontent.com/NodeSecure/js-x-ray/master/package.json&query=$.version&label=Version" alt="npm version">
     </a>
     <a href="https://github.com/NodeSecure/js-x-ray/blob/master/LICENSE">
-      <img src="https://img.shields.io/github/license/Naereen/StrapDown.js.svg?style=for-the-badge" alt="license">
+      <img src="https://img.shields.io/github/license/NodeSecure/js-x-ray.svg?style=for-the-badge" alt="license">
     </a>
     <a href="https://api.securityscorecards.dev/projects/github.com/NodeSecure/js-x-ray">
       <img src="https://api.securityscorecards.dev/projects/github.com/NodeSecure/js-x-ray/badge?style=for-the-badge" alt="ossf scorecard">
@@ -198,7 +198,7 @@ export type ReportOnFile = {
 ## Contributors ✨
 
 <!-- ALL-CONTRIBUTORS-BADGE:START - Do not remove or modify this section -->
-[![All Contributors](https://img.shields.io/badge/all_contributors-10-orange.svg?style=flat-square)](#contributors-)
+[![All Contributors](https://img.shields.io/badge/all_contributors-11-orange.svg?style=flat-square)](#contributors-)
 <!-- ALL-CONTRIBUTORS-BADGE:END -->
 
 Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/docs/en/emoji-key)):
@@ -221,6 +221,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
       <td align="center" valign="top" width="14.28%"><a href="https://www.linkedin.com/in/franck-hallaert/"><img src="https://avatars.githubusercontent.com/u/110826655?v=4?s=100" width="100px;" alt="Franck Hallaert"/><br /><sub><b>Franck Hallaert</b></sub></a><br /><a href="https://github.com/NodeSecure/js-x-ray/commits?author=Aekk0" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://maji.kiwi"><img src="https://avatars.githubusercontent.com/u/33150916?v=4?s=100" width="100px;" alt="Maji"/><br /><sub><b>Maji</b></sub></a><br /><a href="https://github.com/NodeSecure/js-x-ray/commits?author=M4gie" title="Code">💻</a></td>
       <td align="center" valign="top" width="14.28%"><a href="https://github.com/targos"><img src="https://avatars.githubusercontent.com/u/2352663?v=4?s=100" width="100px;" alt="Michaël Zasso"/><br /><sub><b>Michaël Zasso</b></sub></a><br /><a href="https://github.com/NodeSecure/js-x-ray/commits?author=targos" title="Code">💻</a> <a href="https://github.com/NodeSecure/js-x-ray/issues?q=author%3Atargos" title="Bug reports">🐛</a></td>
+      <td align="center" valign="top" width="14.28%"><a href="https://github.com/fabnguess"><img src="https://avatars.githubusercontent.com/u/72697416?v=4?s=100" width="100px;" alt="Kouadio Fabrice Nguessan"/><br /><sub><b>Kouadio Fabrice Nguessan</b></sub></a><br /><a href="#maintenance-fabnguess" title="Maintenance">🚧</a> <a href="https://github.com/NodeSecure/js-x-ray/commits?author=fabnguess" title="Code">💻</a></td>
     </tr>
   </tbody>
 </table>

package/index.js

@@ -122,15 +122,19 @@ function parseScriptExtended(strToAnalyze, options = {}) {
     return body;
   }
   catch (error) {
+    const isIllegalReturn = error.description.includes("Illegal return statement");
+
     if (error.name === "SyntaxError" && (
       error.description.includes("The import keyword") ||
-      error.description.includes("The export keyword")
+      error.description.includes("The export keyword") ||
+      isIllegalReturn
     )) {
       const { body } = meriyah.parseScript(
         cleanedStrToAnalyze,
         {
           ...kMeriyahDefaultOptions,
-          module: true
+          module: true,
+          globalReturn: isIllegalReturn
         }
       );
 

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@nodesecure/js-x-ray",
-  "version": "6.1.1",
+  "version": "6.2.1",
   "description": "JavaScript AST XRay analysis",
   "type": "module",
   "exports": "./index.js",
   "engines": {
-    "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+    "node": ">=18.0.0"
   },
   "scripts": {
     "lint": "eslint src test",
     "prepublishOnly": "pkg-ok",
-    "test-only": "cross-env esm-tape-runner 'test/**/*.spec.js' | tap-monkey",
-    "test": "c8 --all --src ./src --reporter=lcov npm run test-only",
-    "check": "cross-env npm run lint && npm run test-only"
+    "test-only": "glob -c \"node --test-reporter=spec --test\" \"./test/**/*.spec.js\"",
+    "test": "c8 --all --src ./src -r html npm run test-only",
+    "check": "npm run lint && npm run test-only"
   },
   "repository": {
     "type": "git",
@@ -48,14 +48,10 @@
   },
   "devDependencies": {
     "@nodesecure/eslint-config": "^1.6.0",
-    "@slimio/is": "^2.0.0",
-    "@small-tech/esm-tape-runner": "^2.0.0",
-    "@small-tech/tap-monkey": "^1.4.0",
-    "@types/node": "^20.3.0",
-    "c8": "^8.0.0",
-    "cross-env": "^7.0.3",
+    "@types/node": "^20.6.2",
+    "c8": "^8.0.1",
     "eslint": "^8.31.0",
-    "pkg-ok": "^3.0.0",
-    "tape": "^5.6.1"
+    "glob": "^10.3.4",
+    "pkg-ok": "^3.0.0"
   }
 }

package/src/Analysis.js

@@ -88,7 +88,7 @@ export default class Analysis {
     }
 
     // Searching for morse string like "--.- --.--."
-    if (Utils.stringCharDiversity(str, ["\n"]) >= 3 && Utils.isMorse(str)) {
+    if (Utils.isMorse(str)) {
       this.counter.morseLiteral++;
     }
   }

package/src/obfuscators/index.js

@@ -37,11 +37,6 @@ export function isObfuscatedCode(analysis) {
     if (analysis.counter.identifiers > kMinimumIdsCount && uPrefixNames.size > 0) {
       analysis.hasPrefixedIdentifiers = calcAvgPrefixedIdentifiers(analysis, prefix) > 80;
     }
-    // console.log(prefix);
-    // console.log(oneTimeOccurence);
-    // console.log(analysis.hasPrefixedIdentifiers);
-    // console.log(analysis.counter.identifiers);
-    // console.log(analysis.counter.encodedArrayValue);
 
     if (uPrefixNames.size === 1 && freejsobfuscator.verify(analysis, prefix)) {
       encoderName = "freejsobfuscator";

package/src/probes/isRequire.js

@@ -7,7 +7,8 @@ import {
   concatBinaryExpression,
   arrayExpressionToString,
   getMemberExpressionIdentifier,
-  getCallExpressionIdentifier
+  getCallExpressionIdentifier,
+  getCallExpressionArguments
 } from "@nodesecure/estree-ast-utils";
 
 function validateNode(node, { tracer }) {
@@ -89,7 +90,7 @@ function main(node, options) {
 
     // require(Buffer.from("...", "hex").toString());
     case "CallExpression": {
-      walkRequireCallExpression(arg)
+      walkRequireCallExpression(arg, tracer)
         .forEach((depName) => analysis.dependencies.add(depName, node.loc, true));
 
       analysis.addWarning("unsafe-import", null, node.loc);
@@ -103,7 +104,7 @@ function main(node, options) {
   }
 }
 
-function walkRequireCallExpression(nodeToWalk) {
+function walkRequireCallExpression(nodeToWalk, tracer) {
   const dependencies = new Set();
 
   walk(nodeToWalk, {
@@ -122,8 +123,19 @@ function walkRequireCallExpression(nodeToWalk) {
       const fullName = node.callee.type === "MemberExpression" ?
         [...getMemberExpressionIdentifier(node.callee)].join(".") :
         node.callee.name;
+      const tracedFullName = tracer.getDataFromIdentifier(fullName)?.identifierOrMemberExpr ?? fullName;
+
+      switch (tracedFullName) {
+        case "atob": {
+          const nodeArguments = getCallExpressionArguments(node, { tracer });
+          if (nodeArguments !== null) {
+            dependencies.add(
+              Buffer.from(nodeArguments.at(0), "base64").toString()
+            );
+          }
 
-      switch (fullName) {
+          break;
+        }
         case "Buffer.from": {
           const [element] = node.arguments;
 

package/src/warnings.js

@@ -54,16 +54,16 @@ export const warnings = Object.freeze({
 });
 
 export function generateWarning(kind, options) {
-  const { location, file = null, value = null } = options;
+  const { location, file = null, value = null, source = "JS-X-Ray" } = options;
 
   if (kind === "encoded-literal") {
     return Object.assign(
-      { kind, value, location: [utils.toArrayLocation(location)] },
+      { kind, value, location: [utils.toArrayLocation(location)], source },
       warnings[kind]
     );
   }
 
-  const result = { kind, location: utils.toArrayLocation(location) };
+  const result = { kind, location: utils.toArrayLocation(location), source };
   if (utils.notNullOrUndefined(file)) {
     result.file = file;
   }

package/types/warnings.d.ts

@@ -25,6 +25,7 @@ interface WarningDefault {
   kind: WarningName;
   file?: string;
   value: string;
+  source: string; 
   location: WarningLocation | WarningLocation[];
   i18n: string;
   severity: "Information" | "Warning" | "Critical";