jscope 0.4.2__py3-none-any.whl

jscope/analyzers/service_worker_analyzer.py

@@ -0,0 +1,142 @@
+"""Service Worker Analyzer.
+
+Two views of the same feature, from opposite sides:
+  * registration (page side):  navigator.serviceWorker.register('/sw.js')
+  * capabilities (worker side): fetch interception, push, background sync,
+    offline caching, message channel, immediate takeover, importScripts,
+    Workbox precache manifests.
+When the registered script is also present in the project the registration
+gains ARTIFACT_RESOLVED evidence. Precache manifests are useful recon:
+they enumerate shipped assets, including ones no page links to.
+"""
+
+from __future__ import annotations
+
+import re
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import is_test_path
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.parsing import queries as Q
+from jscope.parsing.ast_engine import ParsedFile
+
+_SW_EVENTS = {"install", "activate", "fetch", "push", "sync", "periodicsync", "notificationclick",
+              "notificationclose", "message", "backgroundfetchsuccess", "pushsubscriptionchange"}
+_CAPABILITY = {
+    "fetch": ("capability:fetch_interception",
+              "Worker intercepts every in-scope request. Test cache poisoning, whether authenticated responses get cached "
+              "and served to the next user, and whether the scope is broader than intended."),
+    "push": ("capability:push_notifications",
+             "Check the push-subscription registration endpoint for authorization, and what the payload handler does with attacker-influenced data."),
+    "notificationclick": ("capability:push_notifications",
+                          "Check how notification click data selects the opened URL (open redirect / javascript: handling)."),
+    "sync": ("capability:background_sync",
+             "Queued requests replay later, possibly with stale credentials. Test replay authorization and idempotency."),
+    "periodicsync": ("capability:background_sync",
+                     "Periodic background requests run without a visible page. Test their authorization."),
+    "message": ("capability:message_channel",
+                "Check the message handler validates event.source/origin: any page in scope may be able to drive the worker."),
+}
+_WORKBOX = ("precacheAndRoute", "registerRoute", "workbox", "precache", "StaleWhileRevalidate", "NetworkFirst")
+_SW_NAME = re.compile(r"(^|[-_./])(sw|service-?worker|workbox[-\w]*)(\.[\w.-]+)?\.js$", re.I)
+
+
+class ServiceWorkerAnalyzer(Analyzer):
+    name = "service_worker_analyzer"
+    depends_on: list[str] = []
+    produces_categories = ["service_worker"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        index = Q.FileIndex(ctx.files)
+        cands: dict[str, Candidate] = {}
+
+        def add(subject: str, ev: list[Evidence], test: str | None, meta: dict | None = None):
+            c = cands.get(subject)
+            if c is None:
+                c = cands[subject] = Candidate(category="service_worker", subject=subject, analyzer=self.name,
+                                               evidence=[], attack_surface="service_worker", suggested_test=test,
+                                               metadata=dict(meta or {}))
+            c.evidence += ev
+
+        for pf in ctx.files:
+            if pf.skipped_reason or pf.tree is None:
+                continue
+
+            def ev(node, desc, typ=ET.AST_PATTERN_MATCH):
+                out = [Evidence(typ, desc, self.name, pf.path, pf.line_of(node), pf.node_text(node)[:100].replace("\n", " "))]
+                if ctx.ast.is_in_dead_branch(pf, node):
+                    out.append(Evidence(ET.DEAD_CODE, "sits in a statically dead branch", self.name))
+                if is_test_path(pf.path):
+                    out.append(Evidence(ET.TEST_FIXTURE_CONTEXT, "file looks like a test/mock", self.name))
+                return out
+
+            calls = Q.iter_calls(ctx.ast, pf)
+            sw_events = []
+            for s in calls:
+                if s.callee.endswith("addEventListener") and s.args_resolved and s.args_resolved[0].value in _SW_EVENTS:
+                    recv = s.callee.rsplit(".", 1)[0] if "." in s.callee else ""
+                    if recv in ("self", "this", "globalThis", "") or recv.endswith("self"):
+                        sw_events.append(s)
+            is_sw = bool(sw_events) or any(s.callee in ("self.skipWaiting", "self.clients.claim", "importScripts")
+                                           for s in calls) \
+                or any(m in pf.text for m in ("ServiceWorkerGlobalScope", "self.__WB_MANIFEST")) \
+                or (bool(_SW_NAME.search(pf.path.replace("\\", "/"))) and any(w in pf.text for w in _WORKBOX))
+            # -- page side: registration
+            for s in calls:
+                if s.callee.endswith("serviceWorker.register") and s.args_resolved and s.args_resolved[0].value:
+                    script = s.args_resolved[0].value
+                    e = ev(s.node, f"serviceWorker.register('{script}')")
+                    target = index.by_basename(script)
+                    if target is not None:
+                        e.append(Evidence(ET.ARTIFACT_RESOLVED, f"registered worker script found in project: {target.path}", self.name, target.path))
+                    scope = None
+                    if len(s.args_resolved) > 1 and "scope" in s.args_raw[1]:
+                        scope = s.args_raw[1]
+                    add(f"registration:{script}", e,
+                        "Fetch the worker script from the live origin; check its scope header (Service-Worker-Allowed) and "
+                        "whether it caches authenticated pages.", {"script": script, "options": scope})
+            if not is_sw:
+                continue
+            # -- worker side
+            for s in sw_events:
+                evname = s.args_resolved[0].value
+                if evname in _CAPABILITY:
+                    subj, test = _CAPABILITY[evname]
+                    add(subj, ev(s.node, f"worker handles '{evname}' event"), test, {"events": [evname]})
+                elif evname in ("install", "activate"):
+                    pass
+            for s in calls:
+                if s.callee in ("caches.open", "self.caches.open") and s.args_resolved and s.args_resolved[0].value:
+                    add("capability:offline_cache", ev(s.node, f"opens cache '{s.args_resolved[0].value}'"),
+                        "Check what gets cached: authenticated API responses or HTML in a shared cache can leak across sessions.",
+                        {"caches": [s.args_resolved[0].value]})
+                elif s.callee in ("self.skipWaiting", "self.clients.claim"):
+                    add("behavior:immediate_takeover", ev(s.node, f"{s.callee}() -- new worker takes control immediately"),
+                        "A malicious or buggy worker version activates without waiting for page close; relevant if the worker script URL is attacker-influenced.")
+                elif s.callee == "importScripts" and s.args_resolved:
+                    for r, raw in zip(s.args_resolved, s.args_raw):
+                        if r.value:
+                            add(f"dependency:importScripts:{r.value}", ev(s.node, f"importScripts('{r.value}')"),
+                                "Third-party script runs with worker privileges over every in-scope request; check origin, integrity and takeover risk." if r.value.startswith("http")
+                                else "First-party script loaded into the worker; include it in the analysis.")
+                elif Q.last_segment(s.callee) in ("precacheAndRoute", "precache") and s.node is not None:
+                    args = Q.call_args(s.node)
+                    for item in Q.array_items(args[0]) if args and args[0].type == "array" else []:
+                        url = None
+                        if item.type == "object":
+                            u = Q.object_props(pf, item).get("url")
+                            if u is not None:
+                                rv = ctx.ast.resolve_value(pf, u, Q.bindings_for(ctx.ast, pf))
+                                url = rv.value
+                        elif item.type == "string":
+                            url = pf.node_text(item).strip("'\"")
+                        if url and len(cands) < 400:
+                            add(f"precache:{url}", ev(item, f"Workbox precache entry {url}"),
+                                "Precached assets reveal shipped files: fetch them, especially ones no page links to (old bundles, admin pages, source maps).")
+            if "self.__WB_MANIFEST" in pf.text:
+                node = pf.tree.root_node
+                add("precache:__WB_MANIFEST_placeholder",
+                    [Evidence(ET.MOCK_OR_PLACEHOLDER, "self.__WB_MANIFEST placeholder was never replaced by the build", self.name, pf.path)]
+                    + [Evidence(ET.LITERAL_STRING_MATCH, "Workbox manifest injection marker present", self.name, pf.path)] * 2,
+                    "Build-time placeholder only; the real precache list lives in the built worker.")
+        return list(cands.values())

jscope/analyzers/source_map_analyzer.py

@@ -0,0 +1,119 @@
+"""Source Map Analyzer.
+
+Finds `//# sourceMappingURL=` references and, OFFLINE, tries to resolve them:
+inline data: URIs, or a .map sitting next to the bundle on disk. A resolved
+map with sourcesContent means the application's ORIGINAL source (names,
+comments, un-minified logic) is recoverable -- the single biggest accelerant
+for every other analyzer. `expand_source_maps()` (used by the pipeline when
+`source_maps.expand: true`) feeds recovered app sources back in as virtual
+files so the other analyzers run on readable code.
+
+Never touches the network: if the .map isn't on disk the finding is only
+"a map is referenced", and the suggested test is to fetch it from the origin.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import re
+from pathlib import Path
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import is_test_path
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.parsing.ast_engine import ASTEngine, ParsedFile
+
+_MAP_RE = re.compile(r"//[#@]\s*sourceMappingURL=(\S+)")
+_SENSITIVE_SRC = re.compile(r"(\.env|secret|credential|private|/admin|internal|config/prod|\.pem$|\.key$)", re.I)
+MAX_MAP_BYTES = 50 * 1024 * 1024
+
+
+def load_map(pf: ParsedFile) -> tuple[str, dict | None, str]:
+    """-> (reference, parsed map or None, how it was resolved)."""
+    matches = _MAP_RE.findall(pf.text)
+    if not matches:
+        return "", None, "none"
+    ref = matches[-1]
+    try:
+        if ref.startswith("data:"):
+            payload = ref.split(",", 1)[1]
+            raw = base64.b64decode(payload) if ";base64" in ref.split(",", 1)[0] else payload.encode()
+            return ref[:60] + "...", json.loads(raw), "inline"
+        if "://" in ref or pf.origin != "disk":
+            return ref, None, "remote"
+        candidate = (Path(pf.path).parent / ref).resolve()
+        if candidate.is_file() and candidate.stat().st_size <= MAX_MAP_BYTES:
+            return ref, json.loads(candidate.read_text(encoding="utf-8", errors="replace")), "disk"
+    except (OSError, ValueError, json.JSONDecodeError, IndexError):
+        return ref, None, "unparseable"
+    return ref, None, "not_on_disk"
+
+
+def app_sources(smap: dict) -> list[tuple[str, str]]:
+    """(source path, content) for non-vendor sources that embed content."""
+    out = []
+    contents = smap.get("sourcesContent") or []
+    for name, content in zip(smap.get("sources", []), contents):
+        if not content or "node_modules" in name or name.startswith(("webpack/bootstrap", "(webpack)")):
+            continue
+        out.append((name, content))
+    return out
+
+
+class SourceMapAnalyzer(Analyzer):
+    name = "source_map_analyzer"
+    depends_on: list[str] = []
+    produces_categories = ["source_map"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        for pf in ctx.files:
+            if pf.skipped_reason or pf.origin != "disk":
+                continue
+            ref, smap, how = load_map(pf)
+            if how == "none":
+                continue
+            ev = [Evidence(ET.LITERAL_STRING_MATCH, f"sourceMappingURL comment references '{ref}'", self.name, pf.path)]
+            meta: dict = {"bundle": pf.path, "reference": ref, "resolved": how}
+            test = ("Request the .map next to this bundle on the live origin (same path + '.map'). "
+                    "If it is served, the original source is recoverable.")
+            if is_test_path(pf.path):
+                ev.append(Evidence(ET.TEST_FIXTURE_CONTEXT, "bundle lives in a test/mock location", self.name))
+            if smap is not None:
+                srcs = smap.get("sources", [])
+                app = app_sources(smap)
+                meta.update({"sources_total": len(srcs), "app_sources_with_content": len(app),
+                             "app_sources_sample": [n for n, _ in app[:25]]})
+                ev.append(Evidence(ET.ARTIFACT_RESOLVED,
+                                   f"map resolved ({how}) and parsed: {len(srcs)} sources, {len(app)} application sources with embedded content",
+                                   self.name, pf.path))
+                if app:
+                    ev.append(Evidence(ET.ARTIFACT_RESOLVED, "original application source is recoverable from sourcesContent", self.name, pf.path))
+                hits = [n for n in srcs if _SENSITIVE_SRC.search(n)]
+                if hits:
+                    ev.append(Evidence(ET.NAMING_CONVENTION, f"map lists sensitive-looking sources: {', '.join(hits[:3])}", self.name, pf.path))
+                    meta["sensitive_sources"] = hits[:10]
+                test = ("Original source is recoverable. Run `jscope analyze --expand-source-maps` to analyze it, "
+                        "and confirm whether the .map is publicly served on the origin.")
+            out.append(Candidate(category="source_map", subject=f"sourcemap:{Path(pf.path).name}", analyzer=self.name,
+                                 evidence=ev, attack_surface="source_map", suggested_test=test, metadata=meta))
+        return out
+
+
+def expand_source_maps(files: list[ParsedFile], ast: ASTEngine) -> tuple[list[ParsedFile], int]:
+    """Return extra virtual ParsedFiles for recovered JS application sources."""
+    extra: list[ParsedFile] = []
+    for pf in files:
+        if pf.origin != "disk" or pf.skipped_reason:
+            continue
+        _, smap, how = load_map(pf)
+        if smap is None:
+            continue
+        for name, content in app_sources(smap):
+            if not name.lower().split("?")[0].endswith((".js", ".jsx", ".mjs", ".cjs")):
+                continue            # TS/Vue/Svelte sources can't be parsed by the JS grammar
+            vpf = ast.parse_bytes(content.encode("utf-8", errors="replace"), path=f"{pf.path}!/{name}")
+            vpf.origin = "sourcemap"
+            extra.append(vpf)
+    return extra, len(extra)

jscope/analyzers/storage_analyzer.py

@@ -0,0 +1,125 @@
+"""Storage Analyzer: localStorage / sessionStorage / IndexedDB / cookies.
+
+Findings are per (store, key), aggregated across read/write sites. Keys
+that look credential-bearing in script-readable storage are flagged as
+token-storage attack surface (any XSS can exfiltrate them) -- that is a
+risk *observation*, not a vulnerability claim, and is scored accordingly.
+"""
+
+from __future__ import annotations
+
+import re
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import SENSITIVE_KEY_RE, is_test_path
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.core.graph import EdgeKind, NodeKind
+from jscope.parsing import queries as Q
+from jscope.parsing.ast_engine import ParsedFile
+
+_STORES = {"localStorage", "sessionStorage"}
+_OPS = {"setItem": "write", "getItem": "read", "removeItem": "delete"}
+_COOKIE_NAME_RE = re.compile(r"^\s*([^=;\s]+)\s*=")
+
+
+class StorageAnalyzer(Analyzer):
+    name = "storage_analyzer"
+    depends_on: list[str] = []
+    produces_categories = ["storage"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        cands: dict[str, Candidate] = {}
+        ops: dict[str, set[str]] = {}
+
+        def add(subject: str, ev: list[Evidence], op: str, surface: str | None, test: str | None, meta: dict):
+            c = cands.get(subject)
+            if c is None:
+                c = cands[subject] = Candidate(category="storage", subject=subject, analyzer=self.name,
+                                               evidence=[], attack_surface=surface, suggested_test=test,
+                                               metadata=dict(meta))
+            c.evidence += ev
+            ops.setdefault(subject, set()).add(op)
+
+        for pf in ctx.files:
+            if pf.skipped_reason or pf.tree is None:
+                continue
+            g = ctx.graph
+            for site in Q.iter_calls(ctx.ast, pf):
+                parts = site.callee.split(".")
+                kind = key = store = None
+                if len(parts) >= 2 and parts[-1] in _OPS and parts[-2] in _STORES:
+                    store, kind = parts[-2], _OPS[parts[-1]]
+                    key = site.args_resolved[0] if site.args_resolved else None
+                elif site.callee.endswith("indexedDB.open"):
+                    store, kind = "indexedDB", "open"
+                    key = site.args_resolved[0] if site.args_resolved else None
+                elif parts[0] in ("Cookies", "cookies", "Cookie") and parts[-1] in ("set", "get", "remove"):
+                    store, kind = "cookie", {"set": "write", "get": "read", "remove": "delete"}[parts[-1]]
+                    key = site.args_resolved[0] if site.args_resolved else None
+                if store is None or key is None or key.value is None or key.is_placeholder:
+                    continue
+                self._record(ctx, pf, site.node, site.line, store, key.value, kind, key, add, g)
+
+            # document.cookie = "name=value; Secure; SameSite=Lax"
+            for node in ctx.ast.walk(pf.tree.root_node):
+                if node.type != "assignment_expression":
+                    continue
+                left = node.child_by_field_name("left")
+                if left is None or pf.node_text(left).replace("window.", "") != "document.cookie":
+                    continue
+                rv = ctx.ast.resolve_value(pf, node.child_by_field_name("right"), Q.bindings_for(ctx.ast, pf))
+                if rv.value is None:
+                    continue
+                m = _COOKIE_NAME_RE.match(rv.value)
+                if m:
+                    self._record(ctx, pf, node, pf.line_of(node), "cookie", m.group(1), "write", rv, add,
+                                 g, cookie_attrs=rv.value.lower())
+
+        out = []
+        for subject, c in cands.items():
+            c.metadata["operations"] = sorted(ops[subject])
+            out.append(c)
+        return out
+
+    def _record(self, ctx, pf: ParsedFile, node, line: int, store: str, key: str, op: str, rv, add, g,
+                cookie_attrs: str | None = None) -> None:
+        subject = f"{store}:{key}"
+        ev = [Evidence(ET.AST_PATTERN_MATCH, f"{store} {op} with key '{key}'", self.name, pf.path, line,
+                       pf.node_text(node)[:100].replace("\n", " "))]
+        if rv.resolved_via_symbol:
+            ev.append(Evidence(ET.SYMBOL_RESOLVED, "storage key resolved through a constant", self.name))
+        sensitive = bool(SENSITIVE_KEY_RE.search(key))
+        if sensitive:
+            ev.append(Evidence(ET.NAMING_CONVENTION, f"key '{key}' looks credential-bearing", self.name))
+        if ctx.ast.is_in_dead_branch(pf, node):
+            ev.append(Evidence(ET.DEAD_CODE, "access sits in a statically dead branch", self.name))
+        if is_test_path(pf.path):
+            ev.append(Evidence(ET.TEST_FIXTURE_CONTEXT, "file looks like a test/mock", self.name))
+
+        surface = test = None
+        meta = {"store": store, "key": key, "sensitive": sensitive}
+        if sensitive and store in _STORES:
+            surface = "token_storage"
+            test = ("Script-readable storage: any XSS (or malicious third-party script) can read this. "
+                    "Look for XSS sinks, and check whether the token is long-lived and unscoped.")
+        elif store == "cookie" and cookie_attrs is not None:
+            missing = [f for f in ("secure", "samesite") if f not in cookie_attrs]
+            meta["missing_flags"] = missing
+            meta["note"] = "document.cookie cannot set HttpOnly, so this cookie is script-readable by construction"
+            if sensitive:
+                surface = "cookie_handling"
+                test = "Cookie is set from JS (so never HttpOnly). Check scope/expiry and whether the server trusts it for auth."
+        add(subject, ev, op, surface, test, meta)
+
+        owner = Q.enclosing_function_name(pf, node)
+        sid = f"storage:{subject}"
+        g.add_node(sid, NodeKind.STORAGE, subject, sensitive=sensitive)
+        if owner:
+            cid = f"component:{pf.path}:{owner}"
+            g.add_node(cid, NodeKind.COMPONENT, owner, file=pf.path)
+            g.add_node(f"file:{pf.path}", NodeKind.FILE, pf.path)
+            g.add_edge(f"file:{pf.path}", cid, EdgeKind.CONTAINS, self.name, "AST_PATTERN_MATCH", pf.path)
+            g.add_edge(cid, sid, EdgeKind.USES_STORAGE, self.name, "AST_PATTERN_MATCH", pf.path, line)
+        else:
+            g.add_node(f"file:{pf.path}", NodeKind.FILE, pf.path)
+            g.add_edge(f"file:{pf.path}", sid, EdgeKind.USES_STORAGE, self.name, "AST_PATTERN_MATCH", pf.path, line)

jscope/analyzers/wasm_analyzer.py

@@ -0,0 +1,139 @@
+"""WebAssembly Analyzer (Phase 4).
+
+WASM modules hide client logic (validation, licensing, crypto, anti-abuse) and often embed endpoints. This analyzer is
+static and offline: it parses the module's structure, derives the toolchain and the host capabilities the module imports
+(fetch/eval/storage/websocket), extracts endpoint- and secret-shaped strings, and ties the module to the JS that loads it.
+
+Strings found inside a real data segment get AST_PATTERN_MATCH (we know where they live); strings found only by a raw byte
+scan get literal-match weight only.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import PurePosixPath
+
+from jscope.analyzers.base import Analyzer, ProjectContext
+from jscope.analyzers.common import PATH_RE, classify, is_test_path
+from jscope.analyzers.secret_analyzer import _PATTERNS as SECRET_PATTERNS
+from jscope.core.artifacts import KIND_WASM, Artifact
+from jscope.core.evidence import Candidate, Evidence, EvidenceType as ET
+from jscope.parsing.wasm import parse_wasm, printable_strings
+
+_URL = re.compile(r"https?://[^\s\"'<>\\\x00-\x1f]{6,}")
+_APIPATH = re.compile(r"(?<![\w.:/])/(?:api|v\d+|graphql|rest|admin|internal|auth|oauth|_debug|debug)(?:/[A-Za-z0-9_\-.{}:]+)*")
+_HOST_CAPS = [("fetch", re.compile(r"fetch|xmlhttprequest|xhr", re.I), "makes network requests from inside the module"),
+              ("eval", re.compile(r"(^|_)(eval|function_new|newfunction)(_|$)|__wbg_eval", re.I), "can evaluate dynamic JavaScript"),
+              ("storage", re.compile(r"localstorage|sessionstorage|indexeddb|cookie", re.I), "reads/writes browser storage"),
+              ("websocket", re.compile(r"websocket", re.I), "opens WebSockets"),
+              ("crypto", re.compile(r"crypto|subtle|getrandomvalues", re.I), "uses WebCrypto/random from the host")]
+
+
+def _toolchain(info: dict) -> str | None:
+    mods = {i["module"] for i in info["imports"]}
+    names = " ".join(i["name"] for i in info["imports"])
+    exps = " ".join(e["name"] for e in info["exports"])
+    prod = " ".join(" ".join(v) for v in info["producers"].values()).lower()
+    if "wbg" in mods or "__wbindgen" in exps:
+        return "Rust/wasm-bindgen"
+    if "gojs" in mods:
+        return "Go"
+    if "emscripten" in names or any(m == "env" for m in mods) and "emscripten" in prod:
+        return "Emscripten (C/C++)"
+    if "wasi_snapshot_preview1" in mods or "wasi_unstable" in mods:
+        return "WASI"
+    if "__new" in exps and "__pin" in exps:
+        return "AssemblyScript"
+    if "rust" in prod:
+        return "Rust"
+    if "clang" in prod or "c++" in prod:
+        return "C/C++"
+    return None
+
+
+class WasmAnalyzer(Analyzer):
+    name = "wasm_analyzer"
+    depends_on = ["framework_detector"]
+    produces_categories = ["wasm_module", "endpoint", "secret"]
+
+    def analyze_project(self, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        for art in ctx.artifacts_of(KIND_WASM):
+            try:
+                out.extend(self._module(art, ctx))
+            except Exception as exc:                       # noqa: BLE001
+                ctx.diagnostics.append(f"[wasm_analyzer] {art.path}: {type(exc).__name__}: {exc}")
+        return out
+
+    def _module(self, art: Artifact, ctx: ProjectContext) -> list[Candidate]:
+        out: list[Candidate] = []
+        fname = PurePosixPath(art.path.replace("\\", "/")).name
+        penalty = [Evidence(ET.TEST_FIXTURE_CONTEXT, "module lives in a test/fixture path", self.name)] if is_test_path(art.path) else []
+        info = parse_wasm(art.data)
+        if info["version"] is None:
+            ctx.diagnostics.append(f"[wasm_analyzer] {art.path}: not a valid WebAssembly module")
+            return out
+        if info["truncated"]:
+            ctx.diagnostics.append(f"[wasm_analyzer] {art.path}: module is truncated or malformed; partial results")
+        tool = _toolchain(info)
+        caps = []
+        for key, rx, what in _HOST_CAPS:
+            hit = [i["name"] for i in info["imports"] if rx.search(i["name"])]
+            if hit:
+                caps.append((key, what, hit[0]))
+        refs = [pf.path for pf in ctx.files if pf.origin in ("disk", "html-inline", "vue-sfc") and not pf.skipped_reason and fname in pf.text]
+        refs += [a.path for a in ctx.artifacts if a.kind in ("html", "vue") and fname in a.text]
+        mem = info["memories"][0] if info["memories"] else None
+
+        ev = [Evidence(ET.ARTIFACT_RESOLVED, f"WebAssembly module parsed (v{info['version']}, {len(info['sections'])} section(s), "
+                       f"{len(info['imports'])} import(s), {len(info['exports'])} export(s)" + (f", {tool}" if tool else "") + ")", self.name, art.path),
+              Evidence(ET.AST_PATTERN_MATCH, "binary section table read", self.name, art.path)]
+        for r in sorted(set(refs))[:3]:
+            ev.append(Evidence(ET.IMPORT_CHAIN, f"referenced by {PurePosixPath(r.replace(chr(92), '/')).name}", self.name, r))
+        tests = ["Client logic compiled to WASM is harder to review but not hidden: dump its exports/strings and check whether validation, licensing or "
+                 "access decisions made here are re-checked by the server."]
+        if caps:
+            tests.append("It imports host capabilities (" + ", ".join(c[0] for c in caps) + "): follow the data it sends out or evaluates.")
+        if info["has_name_section"]:
+            tests.append("A `name` section is present, so function names are recoverable (easier reverse engineering).")
+        out.append(Candidate(
+            category="wasm_module", subject=fname, analyzer=self.name, evidence=ev + penalty, attack_surface="wasm",
+            suggested_test=" ".join(tests),
+            metadata={"file": art.path, "toolchain": tool, "imports": len(info["imports"]), "exports": [e["name"] for e in info["exports"]][:40],
+                      "host_capabilities": [c[0] for c in caps], "has_name_section": info["has_name_section"], "referenced_by": sorted(set(refs))[:10],
+                      "memory": mem, "customs": info["customs"], "truncated": info["truncated"]}))
+
+        # ---- strings: endpoints and secrets
+        lo, hi = info["data_range"] or (0, 0)
+        seen: set[str] = set()
+        for off, s in printable_strings(art.data):
+            in_data = lo <= off < hi
+            where = "inside a data segment" if in_data else "found by raw byte scan only"
+            base = [Evidence(ET.AST_PATTERN_MATCH, f"string located {where}", self.name, art.path)] if in_data else []
+            for service_pat, (rx, service) in SECRET_PATTERNS.items():
+                m = rx.search(s)
+                if not m:
+                    continue
+                v = m.group(0)
+                subject = f"{service}:{v[:8]}...{v[-4:]}" if len(v) > 14 else f"{service}:{v}"
+                if subject in seen:
+                    continue
+                seen.add(subject)
+                out.append(Candidate(category="secret", subject=subject, analyzer=self.name,
+                                     evidence=[Evidence(ET.LITERAL_STRING_MATCH, f"{service} {service_pat} pattern inside WASM module", self.name, art.path, None, v[:60])] + base + penalty,
+                                     suggested_test="Credentials compiled into a client WASM module are public. Verify the secret is live, scope it, and rotate if so.",
+                                     metadata={"source": "wasm"}))
+            cands = [m.group(0).rstrip(".,);") for m in _URL.finditer(s)] + [m.group(0) for m in _APIPATH.finditer(s)]
+            for c in cands:
+                path = c
+                if not PATH_RE.match(path) or path in seen or len(path) < 4:
+                    continue
+                seen.add(path)
+                tag = classify(path)
+                out.append(Candidate(
+                    category="endpoint", subject=path, analyzer=self.name,
+                    evidence=[Evidence(ET.LITERAL_STRING_MATCH, "endpoint-shaped string embedded in WASM module", self.name, art.path, None, path[:100])] + base
+                    + ([Evidence(ET.NAMING_CONVENTION, f"path matches '{tag}' naming convention", self.name)] if tag else []) + penalty,
+                    attack_surface=tag, metadata={"source": "wasm", "callee": "wasm-string"},
+                    suggested_test="Endpoints compiled into WASM are invisible to JS-only recon. Request it with and without a session and compare with the endpoints the JS client uses."))
+        return out