whopper 0.7.0 → 0.7.2

package/dist/signatures/technologies/ruby_on_rails.test.js

@@ -0,0 +1,234 @@
+import { describe, it, expect } from "vitest";
+import { applySignature } from "../../analyzer/apply.js";
+import { rubyOnRailsSignature } from "./ruby_on_rails.js";
+function createMockContext(overrides = {}) {
+    return {
+        browser: {},
+        page: {},
+        urls: [],
+        responses: [],
+        cookies: [],
+        javascriptVariables: {},
+        timeoutMs: 30000,
+        timeoutOccurred: false,
+        ...overrides,
+    };
+}
+function createMockResponse(overrides = {}) {
+    return {
+        url: "https://example.com",
+        host: "example.com",
+        isFirstParty: true,
+        status: 200,
+        headers: { "content-type": "text/html" },
+        body: "",
+        ...overrides,
+    };
+}
+function createMockCookie(overrides = {}) {
+    return {
+        name: "_session_id",
+        value: "abc123",
+        domain: "example.com",
+        host: "example.com",
+        isFirstParty: true,
+        path: "/",
+        expires: -1,
+        httpOnly: true,
+        secure: true,
+        sameSite: "Lax",
+        ...overrides,
+    };
+}
+const propshaftDigest = "0a1b2c3d";
+const md5Digest = "0123456789abcdef0123456789abcdef";
+const sha256Digest = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+// No Rails pipeline emits a full 40-char SHA-1; other stacks do.
+const sha1Digest = "0123456789abcdef0123456789abcdef01234567";
+describe("rubyOnRailsSignature", () => {
+    describe("header matching", () => {
+        it("detects Rails from a mod_rails Server header", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        headers: {
+                            "content-type": "text/html",
+                            server: "Apache/2.4.6 mod_rails/4.0.60",
+                        },
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from a mod_rack X-Powered-By header", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        headers: {
+                            "content-type": "text/html",
+                            "x-powered-by": "Phusion Passenger mod_rack",
+                        },
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("does not match an unrelated Server header", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        headers: { "content-type": "text/html", server: "nginx/1.24.0" },
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result).toBeUndefined();
+        });
+    });
+    describe("cookie matching", () => {
+        it("detects Rails from the _session_id cookie", () => {
+            const context = createMockContext({
+                cookies: [createMockCookie({ value: "BAh7B0kiD3Nlc3Npb25faWQ" })],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("does not match an empty _session_id cookie", () => {
+            const context = createMockContext({
+                cookies: [createMockCookie({ value: "" })],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result).toBeUndefined();
+        });
+    });
+    describe("body matching", () => {
+        it("detects Rails from the csrf-param meta tag", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        body: '<meta name="csrf-param" content="authenticity_token" />',
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects the csrf-param meta tag with single-quoted attributes", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        body: "<meta name='csrf-param' content='authenticity_token' />",
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("does not match a csrf-token meta tag alone", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        body: '<meta name="csrf-token" content="abcdef123456" />',
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result).toBeUndefined();
+        });
+    });
+    describe("url matching", () => {
+        function detectFromUrl(url) {
+            const context = createMockContext({
+                responses: [createMockResponse({ url })],
+            });
+            return applySignature(context, rubyOnRailsSignature);
+        }
+        it("detects Rails from a Propshaft asset URL", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${propshaftDigest}.js`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from a Sprockets MD5 asset URL", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${md5Digest}.js`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from a Sprockets SHA-256 asset URL", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${sha256Digest}.js`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from a fingerprinted stylesheet", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${sha256Digest}.css`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from a fingerprinted sourcemap", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${propshaftDigest}.js.map`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from an asset URL carrying the Sprockets debug query", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${md5Digest}.js?body=1`);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("does not match an unfingerprinted application.js", () => {
+            const result = detectFromUrl("https://example.com/assets/application.js");
+            expect(result).toBeUndefined();
+        });
+        it("does not match a full 40-char SHA-1 digest from another pipeline", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${sha1Digest}.js`);
+            expect(result).toBeUndefined();
+        });
+        it("does not match a fingerprinted JSON manifest", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${propshaftDigest}.json`);
+            expect(result).toBeUndefined();
+        });
+        it("does not match a fingerprinted .jsx source", () => {
+            const result = detectFromUrl(`https://example.com/assets/application-${propshaftDigest}.jsx`);
+            expect(result).toBeUndefined();
+        });
+        it("does not match an asset path echoed back in a query string", () => {
+            const result = detectFromUrl(`https://example.com/login?next=/assets/application-${propshaftDigest}.js`);
+            expect(result).toBeUndefined();
+        });
+        // Known limitation, not signature behaviour: this signature carries headers
+        // and cookies, so inferRuntime() classifies it as "server" and the urls loop
+        // skips third-party responses. Assets served from a CDN via
+        // config.asset_host are therefore never evaluated.
+        it("does not evaluate an asset URL served from a third-party CDN host", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        url: `https://cdn.example.net/assets/application-${md5Digest}.js`,
+                        host: "cdn.example.net",
+                        isFirstParty: false,
+                    }),
+                ],
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result).toBeUndefined();
+        });
+    });
+    describe("javascript variable matching", () => {
+        it("detects Rails from the ReactOnRails global", () => {
+            const context = createMockContext({
+                javascriptVariables: {
+                    ReactOnRails: {},
+                },
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+        it("detects Rails from the React on Rails event handler flag", () => {
+            const context = createMockContext({
+                javascriptVariables: {
+                    __REACT_ON_RAILS_EVENT_HANDLERS_RAN_ONCE__: true,
+                },
+            });
+            const result = applySignature(context, rubyOnRailsSignature);
+            expect(result?.name).toBe("Ruby on Rails");
+        });
+    });
+    it("implies Ruby", () => {
+        expect(rubyOnRailsSignature.impliedSoftwares).toContain("Ruby");
+    });
+});
+//# sourceMappingURL=ruby_on_rails.test.js.map

package/dist/signatures/technologies/ruby_on_rails.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby_on_rails.test.js","sourceRoot":"","sources":["../../../src/signatures/technologies/ruby_on_rails.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,SAAS,iBAAiB,CACxB,YAEI,EAAE;IAEN,OAAO;QACL,OAAO,EAAE,EAAwB;QACjC,IAAI,EAAE,EAAqB;QAC3B,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,mBAAmB,EAAE,EAAE;QACvB,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE,KAAK;QACtB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA+B,EAAE;IAC3D,OAAO;QACL,GAAG,EAAE,qBAAqB;QAC1B,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,EAAE;QACR,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,YAA6B,EAAE;IACvD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,YAAY,GAChB,kEAAkE,CAAC;AACrE,iEAAiE;AACjE,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAE9D,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,OAAO,EAAE;4BACP,cAAc,EAAE,WAAW;4BAC3B,MAAM,EAAE,+BAA+B;yBACxC;qBACF,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,OAAO,EAAE;4BACP,cAAc,EAAE,WAAW;4BAC3B,cAAc,EAAE,4BAA4B;yBAC7C;qBACF,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE;qBACjE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;QAC/B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;aAClE,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,OAAO,EAAE,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;aAC3C,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,yDAAyD;qBAChE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,yDAAyD;qBAChE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,mDAAmD;qBAC1D,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,SAAS,aAAa,CAAC,GAAW;YAChC,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;aACzC,CAAC,CAAC;YACH,OAAO,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACvD,CAAC;QAED,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,eAAe,KAAK,CAC/D,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,SAAS,KAAK,CACzD,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,YAAY,KAAK,CAC5D,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,YAAY,MAAM,CAC7D,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,eAAe,SAAS,CACnE,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;YAC5E,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,SAAS,YAAY,CAChE,CAAC;YACF,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;YAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,2CAA2C,CAAC,CAAC;YAC1E,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;YAC1E,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,UAAU,KAAK,CAC1D,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;YACtD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,eAAe,OAAO,CACjE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,aAAa,CAC1B,0CAA0C,eAAe,MAAM,CAChE,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,MAAM,GAAG,aAAa,CAC1B,sDAAsD,eAAe,KAAK,CAC3E,CAAC;YACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,4EAA4E;QAC5E,6EAA6E;QAC7E,4DAA4D;QAC5D,mDAAmD;QACnD,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,GAAG,EAAE,8CAA8C,SAAS,KAAK;wBACjE,IAAI,EAAE,iBAAiB;wBACvB,YAAY,EAAE,KAAK;qBACpB,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;QAC5C,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,mBAAmB,EAAE;oBACnB,YAAY,EAAE,EAAE;iBACjB;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;YAClE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,mBAAmB,EAAE;oBACnB,0CAA0C,EAAE,IAAI;iBACjD;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YAC7D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/signatures/technologies/wordpress.test.js

@@ -86,6 +86,47 @@ describe("wordpressSignature", () => {
             const result = applySignature(context, wordpressSignature);
             expect(result).toBeDefined();
         });
+        it("does not detect WordPress from a third-party URL quoted inside a first-party script", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        url: "https://example.com/js/app.min.js",
+                        host: "example.com",
+                        headers: { "content-type": "application/javascript" },
+                        body: '"https://external.example/wp-content/plugins/foo/bar.js"',
+                    }),
+                ],
+            });
+            const result = applySignature(context, wordpressSignature);
+            expect(result).toBeUndefined();
+        });
+        it("detects WordPress from an in-scope absolute wp-content URL", () => {
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        body: '<link href="https://example.com/wp-content/themes/foo/style.css">',
+                    }),
+                ],
+            });
+            const result = applySignature(context, wordpressSignature);
+            expect(result).toBeDefined();
+        });
+        it("does not read a version across an out-of-scope URL between the tokens", () => {
+            // "WordPress" and "6.4.2" are separated by an out-of-scope URL. Because
+            // the URL is excluded by span (not replaced with whitespace), the version
+            // pattern must not bridge the two into a spurious 6.4.2 detection. An
+            // in-scope relative path still yields a WordPress detection.
+            const context = createMockContext({
+                responses: [
+                    createMockResponse({
+                        body: '<link href="/wp-content/style.css"> WordPress https://external.example/a/b.js 6.4.2',
+                    }),
+                ],
+            });
+            const result = applySignature(context, wordpressSignature);
+            expect(result).toBeDefined();
+            expect(result?.evidences?.every((e) => e.version !== "6.4.2")).toBe(true);
+        });
     });
 });
 //# sourceMappingURL=wordpress.test.js.map

package/dist/signatures/technologies/wordpress.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"wordpress.test.js","sourceRoot":"","sources":["../../../src/signatures/technologies/wordpress.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,SAAS,iBAAiB,CACxB,YAAiD,EAAE;IAEnD,OAAO;QACL,OAAO,EAAE,EAAwB;QACjC,IAAI,EAAE,EAAqB;QAC3B,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,mBAAmB,EAAE,EAAE;QACvB,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE,KAAK;QACtB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA+B,EAAE;IAC3D,OAAO;QACL,GAAG,EAAE,qBAAqB;QAC1B,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,EAAE;QACR,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,mDAAmD;qBAC1D,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,4BAA4B;qBACnC,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,kBAAkB;qBACzB,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,4FAA4F;qBACnG,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,6DAA6D;qBACpE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"wordpress.test.js","sourceRoot":"","sources":["../../../src/signatures/technologies/wordpress.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,SAAS,iBAAiB,CACxB,YAAiD,EAAE;IAEnD,OAAO;QACL,OAAO,EAAE,EAAwB;QACjC,IAAI,EAAE,EAAqB;QAC3B,IAAI,EAAE,EAAE;QACR,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,mBAAmB,EAAE,EAAE;QACvB,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE,KAAK;QACtB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA+B,EAAE;IAC3D,OAAO;QACL,GAAG,EAAE,qBAAqB;QAC1B,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;QACxC,IAAI,EAAE,EAAE;QACR,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,mDAAmD;qBAC1D,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;YAC3E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,4BAA4B;qBACnC,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;YAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,kBAAkB;qBACzB,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,4FAA4F;qBACnG,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,6DAA6D;qBACpE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;YAC7F,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,GAAG,EAAE,mCAAmC;wBACxC,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;wBACrD,IAAI,EAAE,0DAA0D;qBACjE,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;YACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,mEAAmE;qBAC1E,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,SAAS,EAAE;oBACT,kBAAkB,CAAC;wBACjB,IAAI,EAAE,qFAAqF;qBAC5F,CAAC;iBACH;aACF,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whopper",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Whopper is a CLI tool that discovers and detects web technologies used on websites.",
   "scripts": {
     "build": "tsc -p tsconfig.json",