klyrek-js 0.1.0__tar.gz

klyrek_js-0.1.0/.gitignore

@@ -0,0 +1,20 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+.qodo/
+build/
+dist/
+.venv/
+venv/
+.env
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+*.log
+.idea/
+.vscode/
+!.vscode/extensions.json
+klyrek_output/

klyrek_js-0.1.0/PKG-INFO

@@ -0,0 +1,44 @@
+Metadata-Version: 2.4
+Name: klyrek-js
+Version: 0.1.0
+Summary: JavaScript analysis for the Klyrek ecosystem
+Author: Klyrek Contributors
+License: MIT
+Keywords: appsec,javascript,pentesting,reconnaissance,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: klyrek-core
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# klyrek-js
+
+JavaScript analysis. Pure text analysis — takes an already-fetched JS source string (from
+`klyrek-http`/`klyrek-crawler`) rather than making its own requests, so this package has no
+network dependency at all.
+
+- **`endpoints`** — extracts API-shaped path and URL string literals referenced in the source
+  (`"/api/v1/users"`, `"https://api.target.com/graphql"`) as `Endpoint` records.
+- **`secrets`** — regex-based detection of hardcoded credentials (AWS keys, Stripe live keys,
+  Slack tokens, GitHub PATs, private key blocks, generic `api_key`/`secret` assignments), as
+  `Finding` records with the matched value masked (`sk_l...3f9a`) rather than stored in full.
+- **`sourcemap`** — detects a `//# sourceMappingURL=` reference, which (if the `.map` file is
+  publicly reachable) can reconstruct original unminified source.
+
+Third-party SDK/library detection (Stripe.js, Sentry, Google Analytics, ...) deliberately isn't
+duplicated here — `klyrek-tech`'s signature-based `fingerprint()` already works on any response
+body, JS included.
+
+```python
+from klyrek_js.analyze import analyze_js
+
+result = analyze_js(js_source, js_url="https://target.com/static/app.js")
+print(result.endpoints, result.findings)
+```

klyrek_js-0.1.0/README.md

@@ -0,0 +1,24 @@
+# klyrek-js
+
+JavaScript analysis. Pure text analysis — takes an already-fetched JS source string (from
+`klyrek-http`/`klyrek-crawler`) rather than making its own requests, so this package has no
+network dependency at all.
+
+- **`endpoints`** — extracts API-shaped path and URL string literals referenced in the source
+  (`"/api/v1/users"`, `"https://api.target.com/graphql"`) as `Endpoint` records.
+- **`secrets`** — regex-based detection of hardcoded credentials (AWS keys, Stripe live keys,
+  Slack tokens, GitHub PATs, private key blocks, generic `api_key`/`secret` assignments), as
+  `Finding` records with the matched value masked (`sk_l...3f9a`) rather than stored in full.
+- **`sourcemap`** — detects a `//# sourceMappingURL=` reference, which (if the `.map` file is
+  publicly reachable) can reconstruct original unminified source.
+
+Third-party SDK/library detection (Stripe.js, Sentry, Google Analytics, ...) deliberately isn't
+duplicated here — `klyrek-tech`'s signature-based `fingerprint()` already works on any response
+body, JS included.
+
+```python
+from klyrek_js.analyze import analyze_js
+
+result = analyze_js(js_source, js_url="https://target.com/static/app.js")
+print(result.endpoints, result.findings)
+```

klyrek_js-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "klyrek-js"
+version = "0.1.0"
+description = "JavaScript analysis for the Klyrek ecosystem"
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [{ name = "Klyrek Contributors" }]
+keywords = ["security", "reconnaissance", "appsec", "pentesting", "javascript"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+]
+dependencies = [
+    "klyrek-core",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.0", "ruff>=0.6", "mypy>=1.10"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/klyrek_js"]

klyrek_js-0.1.0/src/klyrek_js/__init__.py

@@ -0,0 +1,18 @@
+"""klyrek-js: JavaScript analysis (endpoint extraction, secret scanning, source maps)."""
+
+from klyrek_js.analyze import JsAnalysis, analyze_js
+from klyrek_js.endpoints import extract_endpoints
+from klyrek_js.secrets import scan_for_secrets
+from klyrek_js.sourcemap import find_source_map_url, source_map_finding
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "JsAnalysis",
+    "__version__",
+    "analyze_js",
+    "extract_endpoints",
+    "find_source_map_url",
+    "scan_for_secrets",
+    "source_map_finding",
+]

klyrek_js-0.1.0/src/klyrek_js/analyze.py

@@ -0,0 +1,25 @@
+"""Run every JS analysis (endpoints, secrets, source maps) against one file."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from klyrek_core.models import Endpoint, Finding
+from klyrek_js.endpoints import extract_endpoints
+from klyrek_js.secrets import scan_for_secrets
+from klyrek_js.sourcemap import source_map_finding
+
+
+@dataclass(slots=True)
+class JsAnalysis:
+    endpoints: list[Endpoint] = field(default_factory=list)
+    findings: list[Finding] = field(default_factory=list)
+
+
+def analyze_js(js_source: str, js_url: str) -> JsAnalysis:
+    """Extract endpoints, hardcoded secrets, and source map exposure from a JS file."""
+    findings = scan_for_secrets(js_source, source_url=js_url)
+    map_finding = source_map_finding(js_source, js_url)
+    if map_finding is not None:
+        findings.append(map_finding)
+    return JsAnalysis(endpoints=extract_endpoints(js_source, js_url), findings=findings)

klyrek_js-0.1.0/src/klyrek_js/endpoints.py

@@ -0,0 +1,47 @@
+"""Extract API-like endpoint strings referenced inside JavaScript source."""
+
+from __future__ import annotations
+
+import re
+from urllib.parse import urljoin, urlsplit
+
+from klyrek_core.models import Endpoint
+
+# A quoted string literal that looks like an absolute API path, e.g. "/api/v1/users",
+# '/graphql'. Anchored to a small set of API-shaped prefixes so it doesn't match every
+# relative asset path like "/favicon.ico".
+_PATH_LITERAL = re.compile(r"""["'](/(?:api|v\d+|graphql|rest)[a-zA-Z0-9_\-/{}.]*)["']""")
+
+# Full absolute URLs referenced as string literals.
+_URL_LITERAL = re.compile(r"""["'](https?://[^\s"'<>]+)["']""")
+
+_API_PATH_HINTS = ("/api", "/graphql", "/rest", "/v1", "/v2", "/v3")
+
+
+def _looks_like_api_url(url: str) -> bool:
+    path = urlsplit(url).path.lower()
+    return any(hint in path for hint in _API_PATH_HINTS)
+
+
+def extract_endpoints(js_source: str, base_url: str) -> list[Endpoint]:
+    """Pull API-shaped path and URL string literals out of a JavaScript source file."""
+    seen: set[str] = set()
+    endpoints: list[Endpoint] = []
+
+    for match in _PATH_LITERAL.finditer(js_source):
+        url = urljoin(base_url, match.group(1))
+        if url not in seen:
+            seen.add(url)
+            endpoints.append(
+                Endpoint(url=url, method="GET", source="js-endpoint", discovered_by="klyrek-js")
+            )
+
+    for match in _URL_LITERAL.finditer(js_source):
+        url = match.group(1)
+        if url not in seen and _looks_like_api_url(url):
+            seen.add(url)
+            endpoints.append(
+                Endpoint(url=url, method="GET", source="js-endpoint", discovered_by="klyrek-js")
+            )
+
+    return endpoints

klyrek_js-0.1.0/src/klyrek_js/secrets.py

@@ -0,0 +1,60 @@
+"""Detect hardcoded secrets and API keys embedded in JavaScript source."""
+
+from __future__ import annotations
+
+import re
+
+from klyrek_core.models import Finding, Severity
+
+_GENERIC_ASSIGNMENT = (
+    r"(?i)(?:api[_-]?key|secret[_-]?key|access[_-]?token|client[_-]?secret)"
+    r"""\s*[:=]\s*["'][A-Za-z0-9_\-]{16,}["']"""
+)
+
+_SECRET_PATTERNS: list[tuple[str, str, Severity]] = [
+    ("AWS Access Key ID", r"\bAKIA[0-9A-Z]{16}\b", Severity.HIGH),
+    ("Google API Key", r"\bAIza[0-9A-Za-z\-_]{35}\b", Severity.HIGH),
+    ("Stripe Live Secret Key", r"\bsk_live_[0-9a-zA-Z]{16,}\b", Severity.CRITICAL),
+    ("Stripe Live Publishable Key", r"\bpk_live_[0-9a-zA-Z]{16,}\b", Severity.LOW),
+    ("Slack Token", r"\bxox[baprs]-[0-9A-Za-z\-]{10,}\b", Severity.HIGH),
+    ("GitHub Personal Access Token", r"\bgh[pousr]_[0-9A-Za-z]{36}\b", Severity.HIGH),
+    (
+        "Private Key Block",
+        r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----",
+        Severity.CRITICAL,
+    ),
+    ("Generic API key/secret assignment", _GENERIC_ASSIGNMENT, Severity.MEDIUM),
+]
+
+_COMPILED = [(name, re.compile(pattern), severity) for name, pattern, severity in _SECRET_PATTERNS]
+
+
+def _mask(value: str) -> str:
+    if len(value) <= 8:
+        return "*" * len(value)
+    return f"{value[:4]}...{value[-4:]}"
+
+
+def scan_for_secrets(js_source: str, source_url: str | None = None) -> list[Finding]:
+    """Scan JavaScript source text for hardcoded secrets and API keys.
+
+    Matched values are masked in the evidence (kept to first/last 4 chars) rather than
+    stored in full, since a Finding may end up in a report handed to a third party.
+    """
+    findings: list[Finding] = []
+    for name, pattern, severity in _COMPILED:
+        for match in pattern.finditer(js_source):
+            evidence = [_mask(match.group(0))]
+            if source_url:
+                evidence.append(source_url)
+            findings.append(
+                Finding(
+                    title=f"Hardcoded {name} found in JavaScript",
+                    severity=severity,
+                    description=f"A pattern matching a {name} was found embedded in "
+                    "client-side JavaScript, which is downloadable by anyone visiting the page.",
+                    evidence=evidence,
+                    module="klyrek-js",
+                )
+            )
+    return findings

klyrek_js-0.1.0/src/klyrek_js/sourcemap.py

@@ -0,0 +1,33 @@
+"""Detect an exposed source map referenced by a JavaScript file."""
+
+from __future__ import annotations
+
+import re
+from urllib.parse import urljoin
+
+from klyrek_core.models import Finding, Severity
+
+_SOURCE_MAP_COMMENT = re.compile(r"//[#@]\s*sourceMappingURL=(\S+)")
+
+
+def find_source_map_url(js_source: str, js_url: str) -> str | None:
+    """Return the absolute URL of a referenced source map, if the JS file has one."""
+    match = _SOURCE_MAP_COMMENT.search(js_source)
+    if not match:
+        return None
+    return urljoin(js_url, match.group(1))
+
+
+def source_map_finding(js_source: str, js_url: str) -> Finding | None:
+    """Flag an exposed source map reference as a Finding, if one is present."""
+    map_url = find_source_map_url(js_source, js_url)
+    if map_url is None:
+        return None
+    return Finding(
+        title="JavaScript source map exposed",
+        severity=Severity.LOW,
+        description="This script references a source map, which (if publicly reachable) can "
+        "reconstruct original, unminified source code including comments and file layout.",
+        evidence=[f"{js_url} -> {map_url}"],
+        module="klyrek-js",
+    )

klyrek_js-0.1.0/tests/test_analyze.py

@@ -0,0 +1,21 @@
+from klyrek_js.analyze import analyze_js
+
+
+def test_analyze_combines_endpoints_and_findings():
+    js = """
+        fetch("/api/v1/users");
+        const key = "AKIAIOSFODNN7EXAMPLE";
+        //# sourceMappingURL=app.js.map
+    """
+    result = analyze_js(js, "https://target.com/app.js")
+
+    assert any(e.url == "https://target.com/api/v1/users" for e in result.endpoints)
+    assert any("AWS Access Key" in f.title for f in result.findings)
+    assert any("source map" in f.title.lower() for f in result.findings)
+
+
+def test_analyze_clean_file_has_no_findings_or_endpoints():
+    js = "function greet(name) { return 'hi ' + name; }"
+    result = analyze_js(js, "https://target.com/app.js")
+    assert result.endpoints == []
+    assert result.findings == []

klyrek_js-0.1.0/tests/test_endpoints.py

@@ -0,0 +1,49 @@
+from klyrek_js.endpoints import extract_endpoints
+
+
+def test_relative_api_path_is_extracted():
+    js = 'fetch("/api/v1/users").then(r => r.json());'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert any(e.url == "https://target.com/api/v1/users" for e in endpoints)
+
+
+def test_graphql_path_is_extracted():
+    js = "const client = new ApolloClient({ uri: '/graphql' });"
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert any(e.url == "https://target.com/graphql" for e in endpoints)
+
+
+def test_absolute_api_url_is_extracted():
+    js = 'axios.get("https://api.target.com/v2/orders");'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert any(e.url == "https://api.target.com/v2/orders" for e in endpoints)
+
+
+def test_absolute_non_api_url_is_ignored():
+    js = 'const img = "https://cdn.target.com/logo.png";'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert endpoints == []
+
+
+def test_plain_asset_path_is_not_extracted():
+    js = 'const icon = "/favicon.ico";'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert endpoints == []
+
+
+def test_duplicate_paths_are_deduplicated():
+    js = '"/api/v1/users" and again "/api/v1/users"'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert len(endpoints) == 1
+
+
+def test_endpoints_are_tagged_with_source_and_discovered_by():
+    js = 'fetch("/api/v1/users");'
+    endpoints = extract_endpoints(js, "https://target.com/app.js")
+    assert endpoints[0].source == "js-endpoint"
+    assert endpoints[0].discovered_by == "klyrek-js"
+
+
+def test_no_matches_on_plain_source():
+    js = "function greet() { console.log('hello world'); }"
+    assert extract_endpoints(js, "https://target.com/app.js") == []

klyrek_js-0.1.0/tests/test_secrets.py

@@ -0,0 +1,58 @@
+from klyrek_js.secrets import scan_for_secrets
+
+
+def test_aws_access_key_is_detected():
+    js = 'const key = "AKIAIOSFODNN7EXAMPLE";'
+    findings = scan_for_secrets(js)
+    assert any("AWS Access Key" in f.title for f in findings)
+
+
+def test_stripe_live_secret_key_is_detected_as_critical():
+    js = 'stripe.setApiKey("sk_live_51H8x9K2eZvKYlo2C0000000000");'
+    findings = scan_for_secrets(js)
+    match = next(f for f in findings if "Stripe Live Secret Key" in f.title)
+    assert match.severity.value == "critical"
+
+
+def test_stripe_publishable_key_is_low_severity():
+    js = 'stripe.setPublishableKey("pk_live_51H8x9K2eZvKYlo2C0000000000");'
+    findings = scan_for_secrets(js)
+    match = next(f for f in findings if "Publishable Key" in f.title)
+    assert match.severity.value == "low"
+
+
+def test_private_key_block_is_detected():
+    js = "const key = `-----BEGIN RSA PRIVATE KEY-----\\nMIIEow...`;"
+    findings = scan_for_secrets(js)
+    assert any("Private Key Block" in f.title for f in findings)
+
+
+def test_generic_api_key_assignment_is_detected():
+    js = 'const config = { apiKey: "abcdefghij1234567890" };'
+    findings = scan_for_secrets(js)
+    assert any("Generic API key" in f.title for f in findings)
+
+
+def test_secret_value_is_masked_in_evidence():
+    js = 'const key = "AKIAIOSFODNN7EXAMPLE";'
+    findings = scan_for_secrets(js)
+    evidence = findings[0].evidence[0]
+    assert "AKIAIOSFODNN7EXAMPLE" not in evidence
+    assert evidence.startswith("AKIA")
+
+
+def test_source_url_included_in_evidence_when_given():
+    js = 'const key = "AKIAIOSFODNN7EXAMPLE";'
+    findings = scan_for_secrets(js, source_url="https://target.com/app.js")
+    assert "https://target.com/app.js" in findings[0].evidence
+
+
+def test_no_secrets_in_clean_source():
+    js = "function add(a, b) { return a + b; }"
+    assert scan_for_secrets(js) == []
+
+
+def test_all_findings_tagged_with_module():
+    js = 'const key = "AKIAIOSFODNN7EXAMPLE";'
+    findings = scan_for_secrets(js)
+    assert all(f.module == "klyrek-js" for f in findings)

klyrek_js-0.1.0/tests/test_sourcemap.py

@@ -0,0 +1,37 @@
+from klyrek_js.sourcemap import find_source_map_url, source_map_finding
+
+
+def test_relative_source_map_url_is_resolved():
+    js = "console.log('hi');\n//# sourceMappingURL=app.js.map"
+    url = find_source_map_url(js, "https://target.com/static/app.js")
+    assert url == "https://target.com/static/app.js.map"
+
+
+def test_at_sign_comment_style_is_supported():
+    js = "console.log('hi');\n//@ sourceMappingURL=app.js.map"
+    url = find_source_map_url(js, "https://target.com/static/app.js")
+    assert url == "https://target.com/static/app.js.map"
+
+
+def test_absolute_source_map_url_is_used_as_is():
+    js = "//# sourceMappingURL=https://cdn.target.com/maps/app.js.map"
+    url = find_source_map_url(js, "https://target.com/static/app.js")
+    assert url == "https://cdn.target.com/maps/app.js.map"
+
+
+def test_no_source_map_returns_none():
+    js = "console.log('no map here');"
+    assert find_source_map_url(js, "https://target.com/app.js") is None
+
+
+def test_source_map_finding_is_low_severity():
+    js = "//# sourceMappingURL=app.js.map"
+    finding = source_map_finding(js, "https://target.com/app.js")
+    assert finding is not None
+    assert finding.severity.value == "low"
+    assert finding.module == "klyrek-js"
+
+
+def test_no_finding_when_no_source_map():
+    js = "console.log('clean');"
+    assert source_map_finding(js, "https://target.com/app.js") is None