jscope 0.4.2__py3-none-any.whl

jscope/analyzers/base.py

@@ -0,0 +1,56 @@
+"""Analyzer base class. Every analyzer: independent, declares deps, proposes
+Candidates only -- never Findings directly (Evidence Engine owns promotion)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from jscope.core.artifacts import Artifact
+from jscope.core.evidence import Candidate
+from jscope.core.graph import KnowledgeGraph
+from jscope.parsing.ast_engine import ASTEngine, ParsedFile
+
+
+@dataclass
+class ProjectContext:
+    """Shared read-only context passed to every analyzer run."""
+    files: list[ParsedFile]
+    ast: ASTEngine
+    framework_hints: dict[str, Any] = field(default_factory=dict)
+    config: dict[str, Any] = field(default_factory=dict)
+    graph: KnowledgeGraph = field(default_factory=KnowledgeGraph)
+    diagnostics: list[str] = field(default_factory=list)
+    artifacts: list[Artifact] = field(default_factory=list)      # non-JS inputs (Phase 4)
+    shared: dict[str, Any] = field(default_factory=dict)         # analyzer -> analyzer facts (declare depends_on!)
+    file_diagnostics: dict[str, list[str]] = field(default_factory=dict)   # path -> what was skipped / partially analyzed (FR-02)
+
+    def add_file_diagnostic(self, path: str, message: str) -> None:
+        bucket = self.file_diagnostics.setdefault(path, [])
+        if message not in bucket:
+            bucket.append(message)
+
+    def artifacts_of(self, kind: str) -> list[Artifact]:
+        return [a for a in self.artifacts if a.kind == kind]
+
+
+class Analyzer:
+    name: str = "base"
+    version: str = "0.1.0"
+    depends_on: list[str] = []          # names of analyzers that must run first (hard: error if missing/disabled)
+    run_after: list[str] = []           # soft ordering hint: run after these IF they are enabled; ignored otherwise (Phase 4)
+    produces_categories: list[str] = []  # e.g. ["endpoint"]
+    tier: str = "core"                  # "core" | "verified" | "community" (set by the plugin loader for plugins)
+
+    def analyze_file(self, pf: ParsedFile, ctx: ProjectContext) -> list[Candidate]:
+        """Per-file hook. Override in subclasses that work file-by-file."""
+        return []
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        """Project-wide hook (cross-file). Default: run analyze_file over all files."""
+        out: list[Candidate] = []
+        for pf in ctx.files:
+            if pf.skipped_reason:
+                continue
+            out.extend(self.analyze_file(pf, ctx))
+        return out

jscope/analyzers/common.py

@@ -0,0 +1,78 @@
+"""Helpers shared by analyzers. Kept tiny on purpose: analyzers must stay
+independently usable, so only genuinely common vocabulary lives here."""
+
+from __future__ import annotations
+
+import os
+import re
+
+from jscope.analyzers.endpoint_analyzer import _PATH_RE as PATH_RE, _classify as classify  # noqa: F401
+
+TEST_PATH_RE = re.compile(r"(__tests__|__mocks__|\.test\.|\.spec\.|/test/|/tests/|/mock/|/fixtures?/)", re.I)
+
+GUARD_NAME_RE = re.compile(
+    r"(protected|private|require|guard|authenticated|withauth|authorized|rolegate|permission|"
+    r"canactivate|authgate|loginrequired)", re.I)
+
+SENSITIVE_KEY_RE = re.compile(
+    r"(token|jwt|auth|session|secret|passw(or)?d|credential|api[_-]?key|refresh|bearer|otp)", re.I)
+
+
+_ANALYSIS_ROOTS: list[str] = []
+
+
+def set_analysis_roots(paths) -> None:
+    """Remember the directories being analyzed so test-path heuristics only look *inside* the analysis root.
+
+    Without this, a project that merely lives under e.g. `/home/me/tests/app/` would have every file treated as a test
+    fixture (and its findings demoted), purely because of where it sits on disk."""
+    roots: list[str] = []
+    for p in paths:
+        ap = os.path.abspath(str(p))
+        roots.append((ap if os.path.isdir(ap) else os.path.dirname(ap)).replace("\\", "/").rstrip("/"))
+    _ANALYSIS_ROOTS[:] = roots
+
+
+def is_test_path(path: str) -> bool:
+    norm = path.replace("\\", "/")
+    if _ANALYSIS_ROOTS:
+        absp = os.path.abspath(path).replace("\\", "/")
+        for root in _ANALYSIS_ROOTS:
+            if absp.startswith(root + "/"):
+                norm = absp[len(root):]          # keeps a leading "/" so a top-level `tests/` dir still matches
+                break
+    elif not norm.startswith("/"):
+        norm = "/" + norm
+    return bool(TEST_PATH_RE.search(norm))
+
+
+# --------------------------------------------------------------------------
+# API path matching (Phase 4): spec paths <-> client paths
+# --------------------------------------------------------------------------
+from urllib.parse import urlparse  # noqa: E402
+
+_PARAM_SEG = re.compile(r"^(\{[^}]*\}|\$\{[^}]*\}|:[A-Za-z_]\w*|\[[^\]]*\]|<[^>]*>)$")
+_STATIC_EXT = re.compile(r"\.(js|mjs|css|png|jpe?g|gif|svg|ico|woff2?|ttf|map|wasm|html?|webp|avif)$", re.I)
+
+
+def path_segments(path: str) -> list[str]:
+    """Normalize a path to segments, collapsing every parameter style ({id} ${id} :id [id] <id>) to '{}'."""
+    path = re.sub(r"\$\{[^}]*\}", "{}", path.split("?")[0].split("#")[0])
+    segs = [s for s in path.split("/") if s]
+    return ["{}" if (_PARAM_SEG.match(s) or "{}" in s) else s for s in segs]
+
+
+def segs_match(a: list[str], b: list[str]) -> bool:
+    return len(a) == len(b) and all(x == y or x == "{}" or y == "{}" for x, y in zip(a, b))
+
+
+def split_origin(url: str) -> tuple[str | None, str]:
+    """('host', '/path') for an absolute URL, (None, '/path') for a relative one."""
+    if "://" in url:
+        u = urlparse(url)
+        return u.netloc.lower(), u.path or "/"
+    return None, url
+
+
+def is_static_asset(path: str) -> bool:
+    return bool(_STATIC_EXT.search(path.split("?")[0]))

jscope/analyzers/dataflow_analyzer.py

@@ -0,0 +1,192 @@
+"""Data-flow analyzer (FR-01/FR-02): proposes Candidates for source -> sink paths found by the interprocedural engine.
+
+Every Candidate states what is known and what is assumed. A static data-flow path is a *security hypothesis*: it never
+reaches CONFIRMED on its own (the evidence weights cap it below that) and it carries `verification_status: unverified`
+until `jscope verify` reproduces it.
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import is_test_path
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.core.graph import EdgeKind, NodeKind
+from jscope.dataflow import rules as R
+from jscope.dataflow.engine import DataFlowEngine, Flow
+from jscope.dataflow.modules import ModuleResolver
+
+SURFACE = {"html": "dom_xss_candidate", "code": "code_injection_candidate", "navigation": "open_redirect_candidate",
+           "sql": "sql_injection_candidate", "command": "command_injection_candidate"}
+TESTS = {
+    "html": "Put a unique marker (e.g. `jscope\"><i id=jscx>`) into the source and check, in a browser, whether it is parsed as markup at the sink. "
+            "Use `jscope verify` with a scoped, authorised target to do this safely.",
+    "code": "Send a harmless unique expression through the source and confirm in the browser console whether it is evaluated.",
+    "navigation": "Supply an absolute URL on a domain you control and observe whether the browser navigates there; also try `//host` and `javascript:` forms.",
+    "sql": "Review the server code that builds this query; send a single quote and compare errors/timing in an authorised environment.",
+    "command": "Review how the command string is built; test only with harmless metacharacter probes in an authorised environment.",
+}
+
+
+def _short(path: str) -> str:
+    return os.path.basename(path.split("#")[0]) + ("#" + path.split("#")[1] if "#" in path else "")
+
+
+def flow_to_dict(f: Flow) -> dict[str, Any]:
+    return {
+        "source": {"kind": f.source_kind, "description": R.HUMAN_SOURCE.get(f.source_kind, f.source_kind), "file": f.source_file,
+                   "line": f.source_line, "snippet": f.source_snippet},
+        "sink": {"class": f.sink_class, "name": f.sink_name, "file": f.sink_file, "line": f.sink_line, "snippet": f.sink_snippet},
+        "status": f.status, "cross_file": f.cross_file,
+        "path": [{"file": s[0], "line": s[1], "step": s[2]} for s in f.steps],
+        "mitigations": [{"name": m.name, "effective_for": sorted(m.effective), "uncertain_for": sorted(m.uncertain), "note": m.note}
+                        for m in f.mitigations],
+        "assumptions": list(f.assumptions),
+    }
+
+
+class DataFlowAnalyzer(Analyzer):
+    name = "dataflow_analyzer"
+    version = "0.5.0"
+    depends_on: list[str] = []
+    run_after = ["framework_detector"]
+    produces_categories = ["dataflow"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        usable = []
+        for pf in ctx.files:
+            if pf.skipped_reason:
+                ctx.add_file_diagnostic(pf.path, f"not analyzed: {pf.skipped_reason}")
+            elif pf.tree is None:
+                ctx.add_file_diagnostic(pf.path, "not analyzed: no syntax tree")
+            else:
+                if pf.syntax_errors:
+                    ctx.add_file_diagnostic(pf.path, f"partially analyzed: {pf.syntax_errors} syntax error node(s); "
+                                                     "constructs inside them are invisible to JScope")
+                usable.append(pf)
+        keys = [(pf.path.split("#")[0] if pf.origin == "vue-sfc" else pf.path) for pf in usable]
+        resolver = ModuleResolver(keys, aliases=ctx.config.get("module_aliases") or {})
+        vue_templates = self._vue_templates(ctx)
+        engine = DataFlowEngine(usable, resolver, vue_templates)
+
+        cache = ctx.shared.get("dataflow_cache")                 # jscope.core.cache.AnalysisCache | None (FR-07)
+        if cache is not None:
+            stats = cache.run(engine, usable)
+            ctx.diagnostics.append(stats.summary())
+            ctx.shared["incremental"] = {"reused": stats.reused, "reanalyzed": stats.reanalyzed, "dropped": stats.dropped}
+        else:
+            engine.run()
+
+        for lim in engine.limitations:
+            if lim.kind in ("unresolved-import", "dynamic-import", "dynamic-require", "budget", "circular-import"):
+                ctx.add_file_diagnostic(lim.file, f"{lim.kind}: {lim.message}")
+        for path in engine.truncated_files:
+            ctx.add_file_diagnostic(path, "partially analyzed: data-flow budget exceeded")
+        if resolver.tsconfig_files:
+            ctx.shared["tsconfig_files"] = sorted(set(resolver.tsconfig_files))
+
+        flows = sorted(engine.flows.values(), key=lambda f: (f.sink_file, f.sink_line, f.source_file, f.source_line))
+        self._populate_graph(ctx, flows)
+        ctx.shared["dataflow"] = {
+            "flows": [flow_to_dict(f) for f in flows],
+            "limitations": [{"file": l.file, "line": l.line, "kind": l.kind, "message": l.message} for l in engine.limitations],
+            "import_edges": {k: sorted(v) for k, v in engine.import_edges.items()},
+            "unresolved_imports": [{"file": a, "line": b, "specifier": c, "reason": d} for a, b, c, d in engine.unresolved_imports],
+            "counts": {s: sum(1 for f in flows if f.status == s) for s in ("candidate", "uncertain", "sanitized", "unreachable")},
+        }
+        return [self._candidate(f, ctx, engine) for f in flows if f.status != "sanitized"]
+
+    def _populate_graph(self, ctx: ProjectContext, flows) -> None:
+        """FR-05: every flow becomes `data_source -[flows_to]-> data_sink` in the knowledge graph, file-attributed and
+        tagged with how certain the path is -- distinct from an unrelated finding simply mentioning the same file."""
+        g = ctx.graph
+        for f in flows:
+            src_id = f"dsrc:{f.source_file}:{f.source_line}:{f.source_kind}"
+            sink_id = f"dsink:{f.sink_file}:{f.sink_line}:{f.sink_name}"
+            g.add_node(src_id, NodeKind.DATA_SOURCE, R.HUMAN_SOURCE.get(f.source_kind, f.source_kind), kind_detail=f.source_kind)
+            g.add_node(sink_id, NodeKind.DATA_SINK, f.sink_name, sink_class=f.sink_class)
+            exactness = "exact" if not f.assumptions and f.status != "uncertain" else "heuristic"
+            g.add_edge(src_id, sink_id, EdgeKind.FLOWS_TO, self.name,
+                      "DATA_FLOW" if f.status != "sanitized" else "DATA_FLOW_SANITIZED", f.sink_file, f.sink_line,
+                      note=f"status={f.status} exactness={exactness}" + (f"; assumes {'; '.join(f.assumptions)}" if f.assumptions else ""))
+            src_file_node, sink_file_node = f"file:{f.source_file}", f"file:{f.sink_file}"
+            g.add_node(src_file_node, NodeKind.FILE, f.source_file.rsplit("/", 1)[-1])
+            g.add_node(sink_file_node, NodeKind.FILE, f.sink_file.rsplit("/", 1)[-1])
+            g.add_edge(src_file_node, src_id, EdgeKind.CONTAINS, self.name, "AST_PATTERN_MATCH", f.source_file, f.source_line)
+            g.add_edge(sink_file_node, sink_id, EdgeKind.CONTAINS, self.name, "AST_PATTERN_MATCH", f.sink_file, f.sink_line)
+
+    # --------------------------------------------------------------------------------------------------
+    def _vue_templates(self, ctx: ProjectContext) -> list[tuple]:
+        out = []
+        try:
+            from jscope.parsing.html import soup
+        except Exception:      # noqa: BLE001
+            return out
+        for art in ctx.artifacts_of("vue"):
+            try:
+                tpl = soup(art).find("template")
+                if tpl is None:
+                    continue
+                for el in tpl.find_all(True):
+                    expr = el.attrs.get("v-html")
+                    if isinstance(expr, str) and expr.strip():
+                        out.append((art.path + "#script", art.path, getattr(el, "sourceline", None) or 1, expr))
+            except Exception as exc:     # noqa: BLE001
+                ctx.add_file_diagnostic(art.path, f"template analysis failed: {type(exc).__name__}")
+        # script paths for lang="ts" blocks carry a suffix; make both spellings match
+        extra = []
+        pfs = {pf.path for pf in ctx.files}
+        for sp, ap, ln, ex in out:
+            for alt in (sp + ".ts", sp + ".tsx"):
+                if alt in pfs:
+                    extra.append((alt, ap, ln, ex))
+        return out + extra
+
+    def _candidate(self, f: Flow, ctx: ProjectContext, engine: DataFlowEngine) -> Candidate:
+        src_h = R.HUMAN_SOURCE.get(f.source_kind, f.source_kind)
+        subject = (f"{f.source_kind} -> {f.sink_name} @ {_short(f.sink_file)}:{f.sink_line}"
+                   f" (source {_short(f.source_file)}:{f.source_line})")
+        path_txt = " -> ".join(f"{_short(s[0])}:{s[1]} {s[2]}" for s in f.steps)
+        partial = bool(f.assumptions) or f.status == "uncertain"
+        ev: list[Evidence] = [
+            Evidence(ET.AST_PATTERN_MATCH, f"{R.sink_label(f.sink_class)} sink {f.sink_name} receives a value derived from {src_h}",
+                     self.name, f.sink_file, f.sink_line, f.sink_snippet, {"sink_class": f.sink_class}),
+        ]
+        why = [f"source: {src_h} at {_short(f.source_file)}:{f.source_line}"]
+        if f.assumptions:
+            why.append("assumptions: " + "; ".join(f.assumptions))
+        if f.status == "uncertain":
+            why.append("uncertain validation: " + "; ".join(f"{m.name} ({m.note})" if m.note else m.name for m in f.mitigations))
+        ev.append(Evidence(
+            ET.DATA_FLOW_PARTIAL if partial else ET.DATA_FLOW,
+            ("PARTIAL data-flow path (" + "; ".join(why[1:]) + "): " if partial else "data-flow path: ") + path_txt,
+            self.name, f.source_file, f.source_line, f.source_snippet,
+            {"path": [{"file": s[0], "line": s[1], "step": s[2]} for s in f.steps], "partial": partial}))
+        if f.cross_file:
+            ev.append(Evidence(ET.IMPORT_CHAIN, f"the path crosses {len(set(f.files))} files: " + " -> ".join(_short(x) for x in f.files),
+                               self.name, f.sink_file, f.sink_line, None, {"files": list(f.files)}))
+        if f.status == "unreachable":
+            ev.append(Evidence(ET.DEAD_CODE, "the sink sits in a branch that is statically never taken", self.name, f.sink_file, f.sink_line))
+        if is_test_path(f.sink_file):
+            ev.append(Evidence(ET.TEST_FIXTURE_CONTEXT, "sink lives in a test/mock/fixture path", self.name, f.sink_file, f.sink_line))
+        low = f.sink_file.lower()
+        if ".min." in low or "/vendor/" in low or "node_modules" in low:
+            ev.append(Evidence(ET.VENDOR_CODE, "sink is inside vendor/minified code", self.name, f.sink_file, f.sink_line))
+        hints = ctx.framework_hints
+        if (f.sink_name == "dangerouslySetInnerHTML" and "react" in hints) or (f.sink_name == "v-html" and "vue" in hints):
+            ev.append(Evidence(ET.FRAMEWORK_CONTEXT, f"{f.sink_name} is the framework's explicit raw-HTML escape hatch", self.name,
+                               f.sink_file, f.sink_line))
+        limitations = list(f.assumptions)
+        limitations.append("static analysis only: exploitability depends on runtime behaviour and server-side handling that JScope has not observed")
+        if f.status == "uncertain":
+            limitations.append("a validator on the path may or may not be sufficient; verify manually")
+        return Candidate(
+            category="dataflow", subject=subject, analyzer=self.name, evidence=ev,
+            attack_surface=SURFACE.get(f.sink_class), suggested_test=TESTS.get(f.sink_class),
+            metadata={
+                "flow": flow_to_dict(f), "sink_class": f.sink_class, "source_kind": f.source_kind, "flow_status": f.status,
+                "cross_file": f.cross_file, "limitations": limitations,
+                "evidence_class": "security_hypothesis", "verification_status": "unverified",
+            })

jscope/analyzers/endpoint_analyzer.py

@@ -0,0 +1,150 @@
+"""Endpoint Analyzer.
+
+Understanding over extraction: doesn't just regex for path-shaped strings.
+Looks at fetch/axios/$.ajax/XHR call *shapes* via the AST, tries to resolve
+the URL argument through simple const propagation, and classifies the path
+by naming convention (admin/internal/debug/versioned) to seed attack-surface
+tagging. Depends on framework_detector so it can flag /api/* differently
+when Next.js is present (Server Actions/API routes have a different auth
+model than an arbitrary fetch target).
+"""
+
+from __future__ import annotations
+
+import re
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.core.evidence import Candidate, Evidence, EvidenceType
+from jscope.parsing.ast_engine import ParsedFile
+
+_PATH_RE = re.compile(r"^(https?://[^\s'\"]+|/[a-zA-Z0-9_\-./{}\[\]:]*)$")
+
+_SENSITIVE_PATTERNS = {
+    "admin": re.compile(r"/(admin|administrator)(/|$)", re.I),
+    "internal": re.compile(r"/(internal|_internal)(/|$)", re.I),
+    "debug": re.compile(r"/(_debug|debug)(/|$)", re.I),
+    "export": re.compile(r"/(export|download)(/|$)", re.I),
+    "upload": re.compile(r"/(upload)(/|$)", re.I),
+    "payment": re.compile(r"/(payment|billing|checkout|stripe)(/|$)", re.I),
+    "idor_candidate": re.compile(r"(^|/)[{:\[]+(id|[a-z]+_?id)[}\]]*(/|$)|(^|/)(id|user_?id|account_?id)(/|$)", re.I),
+    "graphql": re.compile(r"/graphql", re.I),
+    "auth": re.compile(r"/(auth|login|logout|register|password|token|oauth)(/|$)", re.I),
+}
+
+_METHOD_FROM_CALLEE = {
+    "axios.get": "GET", "axios.post": "POST", "axios.put": "PUT",
+    "axios.delete": "DELETE", "axios.patch": "PATCH",
+    "$.get": "GET", "$.post": "POST",
+}
+
+
+def _classify(path: str) -> str | None:
+    for tag, pattern in _SENSITIVE_PATTERNS.items():
+        if pattern.search(path):
+            return tag
+    return None
+
+
+class EndpointAnalyzer(Analyzer):
+    name = "endpoint_analyzer"
+    depends_on = ["framework_detector"]
+    produces_categories = ["endpoint"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        ctx.shared.setdefault("js_endpoints", {})
+        ctx.shared["endpoint_analyzer_ran"] = True     # consumers only make "client never calls X" claims if this is set
+        return super().analyze_project(ctx)
+
+    def analyze_file(self, pf: ParsedFile, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        for site in ctx.ast.find_calls(pf):
+            request_like = site.callee == "fetch" or site.callee.startswith(("axios", "$.get", "$.post", "$.ajax"))
+            resolved = site.args_resolved[0] if site.args_resolved else None
+            if resolved is None or resolved.value is None or resolved.is_placeholder:
+                if request_like:
+                    # a request whose URL we cannot resolve: it may be the "missing" caller of a documented operation
+                    ctx.shared["unresolved_client_calls"] = ctx.shared.get("unresolved_client_calls", 0) + 1
+                continue
+            path = resolved.value
+            if not _PATH_RE.match(path):
+                if request_like and ("${" in path or "`" in path or not path.startswith(("/", "http"))):
+                    ctx.shared["unresolved_client_calls"] = ctx.shared.get("unresolved_client_calls", 0) + 1   # dynamic URL
+                continue
+            if "${" in path:
+                # unresolved template interpolation -- still informative but weaker
+                pass
+
+            evidence = [Evidence(
+                type=EvidenceType.AST_PATTERN_MATCH,
+                description=f"{site.callee}() call with this URL argument",
+                analyzer=self.name,
+                file=pf.path,
+                line=site.line,
+                snippet=site.args_raw[0][:120],
+            )]
+            if resolved.is_literal:
+                evidence.append(Evidence(
+                    type=EvidenceType.LITERAL_STRING_MATCH,
+                    description="URL is a literal string, not dynamically constructed",
+                    analyzer=self.name,
+                ))
+            if resolved.resolved_via_symbol:
+                evidence.append(Evidence(
+                    type=EvidenceType.SYMBOL_RESOLVED,
+                    description="URL resolved through a local variable binding, not a raw literal in the call",
+                    analyzer=self.name,
+                ))
+
+            tag = _classify(path)
+            if tag:
+                evidence.append(Evidence(
+                    type=EvidenceType.NAMING_CONVENTION,
+                    description=f"path matches '{tag}' naming convention",
+                    analyzer=self.name,
+                ))
+
+            if "Next.js" in ctx.framework_hints and path.startswith("/api/"):
+                evidence.append(Evidence(
+                    type=EvidenceType.FRAMEWORK_CONTEXT,
+                    description="Next.js detected in project; /api/* path matches its API route convention",
+                    analyzer=self.name,
+                ))
+
+            if ctx.ast.is_in_dead_branch(pf, site.node):
+                evidence.append(Evidence(
+                    type=EvidenceType.DEAD_CODE,
+                    description="call is inside a branch gated on a falsy/dev-only condition",
+                    analyzer=self.name,
+                ))
+
+            method = _METHOD_FROM_CALLEE.get(site.callee, "GET" if site.callee == "fetch" else None)
+            suggested_test = None
+            if tag == "idor_candidate":
+                suggested_test = "Vary the ID parameter across accounts/sessions and diff authorization results."
+            elif tag == "admin" or tag == "internal":
+                suggested_test = "Request as an unauthenticated / low-privilege user and check for missing access control."
+            elif tag == "auth":
+                suggested_test = "Test auth flow for JWT/session weaknesses, rate limiting, and response differences on valid vs invalid input."
+
+            if not any(e.type == EvidenceType.DEAD_CODE for e in evidence):
+                # shared fact for api_correlation: "the client really calls this" (not dead code)
+                info = ctx.shared.setdefault("js_endpoints", {}).setdefault(
+                    path, {"methods": set(), "reliable_methods": set(), "fetch": False, "sites": []})
+                if method:
+                    info["methods"].add(method)
+                    if site.callee in _METHOD_FROM_CALLEE:       # axios.post etc. state the method; bare fetch() does not
+                        info["reliable_methods"].add(method)
+                if site.callee == "fetch":
+                    info["fetch"] = True
+                info["sites"].append((pf.path, site.line))
+
+            out.append(Candidate(
+                category="endpoint",
+                subject=path,
+                analyzer=self.name,
+                evidence=evidence,
+                attack_surface=tag,
+                suggested_test=suggested_test,
+                metadata={"method": method, "callee": site.callee},
+            ))
+        return out

jscope/analyzers/framework_detector.py

@@ -0,0 +1,82 @@
+"""Framework Detector.
+
+No deps on other analyzers -- it runs first, and other analyzers (Endpoint,
+Router) consult `ctx.framework_hints` afterward for framework-aware
+suppression/classification (design-brainstorm.md §3.3).
+
+v1 scope, deliberately phased down per design-brainstorm.md §5:
+React + Next.js get deep-ish treatment; Vue/Nuxt basic; everything else is
+"detected, generic analysis applied" via a lexical marker table.
+"""
+
+from __future__ import annotations
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.core.evidence import Candidate, Evidence, EvidenceType
+from jscope.parsing.ast_engine import ParsedFile
+
+# marker -> (framework, evidence description)
+_MARKERS: dict[str, tuple[str, str]] = {
+    "__NEXT_DATA__": ("Next.js", "found __NEXT_DATA__ runtime marker"),
+    "_next/static": ("Next.js", "found _next/static chunk path convention"),
+    "__next_f": ("Next.js", "found Next.js App Router flight marker (__next_f)"),
+    "ReactDOM": ("React", "found ReactDOM global reference"),
+    "react.production.min": ("React", "found React production bundle fingerprint"),
+    "__vue__": ("Vue", "found __vue__ instance marker"),
+    "Vue.config": ("Vue", "found Vue.config reference"),
+    "_nuxt/": ("Nuxt", "found _nuxt/ chunk path convention"),
+    "__NUXT__": ("Nuxt", "found __NUXT__ runtime marker"),
+    "ng-version": ("Angular", "found ng-version attribute reference"),
+    "@angular/core": ("Angular", "found @angular/core import reference"),
+    "svelte-hydrate": ("Svelte", "found svelte-hydrate marker"),
+    "__SVELTEKIT__": ("Svelte", "found SvelteKit runtime marker"),
+    "__remixContext": ("Remix", "found __remixContext runtime marker"),
+    "astro-island": ("Astro", "found astro-island custom element marker"),
+}
+
+
+class FrameworkDetector(Analyzer):
+    name = "framework_detector"
+    depends_on = []
+    produces_categories = ["framework"]
+
+    def analyze_file(self, pf: ParsedFile, ctx: ProjectContext) -> list[Candidate]:
+        text = pf.text
+        out: list[Candidate] = []
+        for marker, (framework, desc) in _MARKERS.items():
+            if marker in text:
+                line = text[: text.index(marker)].count("\n") + 1
+                out.append(Candidate(
+                    category="framework",
+                    subject=framework,
+                    analyzer=self.name,
+                    evidence=[Evidence(
+                        type=EvidenceType.LITERAL_STRING_MATCH,
+                        description=desc,
+                        analyzer=self.name,
+                        file=pf.path,
+                        line=line,
+                        snippet=marker,
+                    )],
+                ))
+        return out
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        candidates = super().analyze_project(ctx)
+        # aggregate: bump confidence by adding a second, cross-file
+        # NAMING_CONVENTION-style piece of evidence when a framework shows
+        # up in 2+ files (more than a stray string in a vendor chunk).
+        counts: dict[str, int] = {}
+        for c in candidates:
+            counts[c.subject] = counts.get(c.subject, 0) + 1
+        for c in candidates:
+            if counts[c.subject] >= 2:
+                c.evidence.append(Evidence(
+                    type=EvidenceType.AST_PATTERN_MATCH,
+                    description=f"{c.subject} marker recurs across {counts[c.subject]} files",
+                    analyzer=self.name,
+                ))
+            # populate framework_hints for downstream analyzers
+            ctx.framework_hints.setdefault(c.subject, 0)
+            ctx.framework_hints[c.subject] += 1
+        return candidates