Skip to content

Commit

Permalink
refactor: migrate to NodeSecure org
Browse files Browse the repository at this point in the history
  • Loading branch information
fraxken committed Jun 5, 2021
1 parent 532de80 commit 863d4ab
Show file tree
Hide file tree
Showing 40 changed files with 2,508 additions and 5,074 deletions.
13 changes: 9 additions & 4 deletions .editorconfig
Original file line number Diff line number Diff line change
@@ -1,9 +1,14 @@
# Editor configuration, see https://editorconfig.org
root = true

[*]
indent_size = 4
indent_style = space
end_of_line = lf
charset = utf-8
trim_trailing_whitespace = true
indent_style = space
indent_size = 2
insert_final_newline = true
trim_trailing_whitespace = true
end_of_line = lf

[*.md]
max_line_length = off
trim_trailing_whitespace = false
1 change: 0 additions & 1 deletion .eslintignore
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
test/fixtures
test/utils
cases/
temp.js
8 changes: 4 additions & 4 deletions .eslintrc
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"extends": "@slimio/eslint-config",
"rules": {
"jsdoc/require-jsdoc": "off",
"lines-between-class-members": "off"
"extends": "@nodesecure/eslint-config",
"parserOptions": {
"sourceType": "module",
"requireConfigFile": false
}
}
16 changes: 8 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# js-x-ray
![version](https://img.shields.io/badge/dynamic/json.svg?url=https://raw.githubusercontent.com/fraxken/js-x-ray/master/package.json&query=$.version&label=Version)
[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/fraxken/js-x-ray/commit-activity)
![version](https://img.shields.io/badge/dynamic/json.svg?url=https://raw.githubusercontent.com/NodeSecure/js-x-ray/master/package.json&query=$.version&label=Version)
[![Maintenance](https://img.shields.io/badge/Maintained%3F-yes-green.svg)](https://github.com/NodeSecure/js-x-ray/commit-activity)
[![Security Responsible Disclosure](https://img.shields.io/badge/Security-Responsible%20Disclosure-yellow.svg)](https://github.com/nodejs/security-wg/blob/master/processes/responsible_disclosure_template.md
)
[![mit](https://img.shields.io/github/license/Naereen/StrapDown.js.svg)](https://github.com/fraxken/js-x-ray/blob/master/LICENSE)
![dep](https://img.shields.io/david/fraxken/js-x-ray)
[![mit](https://img.shields.io/github/license/Naereen/StrapDown.js.svg)](https://github.com/NodeSecure/js-x-ray/blob/master/LICENSE)
![dep](https://img.shields.io/david/NodeSecure/js-x-ray)
![size](https://img.shields.io/bundlephobia/min/js-x-ray)


Expand Down Expand Up @@ -32,9 +32,9 @@ Most of the time these hackers will try to hide the behaviour of their codes as
This package is available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com).

```bash
$ npm i js-x-ray
$ npm i @nodesecure/js-x-ray
# or
$ yarn add js-x-ray
$ yarn add @nodesecure/js-x-ray
```

## Usage example
Expand All @@ -57,8 +57,8 @@ require(Buffer.from("6673", "hex").toString());

Then use `js-x-ray` to run an analysis of the JavaScript code:
```js
const { runASTAnalysis } = require("js-x-ray");
const { readFileSync } = require("fs");
import { runASTAnalysis } from "@nodesecure/js-x-ray";
import { readFileSync } from "fs";

const str = readFileSync("./file.js", "utf-8");
const { warnings, dependencies } = runASTAnalysis(str);
Expand Down
15 changes: 0 additions & 15 deletions babel.config.js

This file was deleted.

111 changes: 53 additions & 58 deletions index.js
Original file line number Diff line number Diff line change
@@ -1,61 +1,56 @@
"use strict";

// Require Third-party Dependencies
const { walk } = require("estree-walker");
const meriyah = require("meriyah");

// Require Internal Dependencies
const Analysis = require("./src/Analysis");

function runASTAnalysis(str, options = Object.create(null)) {
const { module = true, isMinified = false } = options;

// Note: if the file start with a shebang then we remove it because 'parseScript' may fail to parse it.
// Example: #!/usr/bin/env node
const strToAnalyze = str.charAt(0) === "#" ? str.slice(str.indexOf("\n")) : str;
const { body } = meriyah.parseScript(strToAnalyze, {
next: true, loc: true, raw: true, module: Boolean(module)
});

const sastAnalysis = new Analysis();

// we walk each AST Nodes, this is a purely synchronous I/O
walk(body, {
enter(node) {
// Skip the root of the AST.
if (Array.isArray(node)) {
return;
}

const action = sastAnalysis.walk(node);
if (action === "skip") {
this.skip();
}
}
});

const dependencies = sastAnalysis.dependencies;
const { idsLengthAvg, stringScore, warnings } = sastAnalysis.getResult(isMinified);
const isOneLineRequire = body.length <= 1 && dependencies.size <= 1;

return {
dependencies, warnings, idsLengthAvg, stringScore, isOneLineRequire
};
// Import Third-party Dependencies
import { walk } from "estree-walker";
import * as meriyah from "meriyah";

// Import Internal Dependencies
import Analysis from "./src/Analysis.js";

export function runASTAnalysis(str, options = Object.create(null)) {
const { module = true, isMinified = false } = options;

// Note: if the file start with a shebang then we remove it because 'parseScript' may fail to parse it.
// Example: #!/usr/bin/env node
const strToAnalyze = str.charAt(0) === "#" ? str.slice(str.indexOf("\n")) : str;
const { body } = meriyah.parseScript(strToAnalyze, {
next: true, loc: true, raw: true, module: Boolean(module)
});

const sastAnalysis = new Analysis();

// we walk each AST Nodes, this is a purely synchronous I/O
walk(body, {
enter(node) {
// Skip the root of the AST.
if (Array.isArray(node)) {
return;
}

const action = sastAnalysis.walk(node);
if (action === "skip") {
this.skip();
}
}
});

const dependencies = sastAnalysis.dependencies;
const { idsLengthAvg, stringScore, warnings } = sastAnalysis.getResult(isMinified);
const isOneLineRequire = body.length <= 1 && dependencies.size <= 1;

return {
dependencies, warnings, idsLengthAvg, stringScore, isOneLineRequire
};
}

module.exports = {
runASTAnalysis,
CONSTANTS: {
Warnings: Object.freeze({
parsingError: "ast-error",
unsafeImport: "unsafe-import",
unsafeRegex: "unsafe-regex",
unsafeStmt: "unsafe-stmt",
unsafeAssign: "unsafe-assign",
encodedLiteral: "encoded-literal",
shortIdentifiers: "short-identifiers",
suspiciousLiteral: "suspicious-literal",
obfuscatedCode: "obfuscated-code"
})
}
export const CONSTANTS = {
Warnings: Object.freeze({
parsingError: "ast-error",
unsafeImport: "unsafe-import",
unsafeRegex: "unsafe-regex",
unsafeStmt: "unsafe-stmt",
unsafeAssign: "unsafe-assign",
encodedLiteral: "encoded-literal",
shortIdentifiers: "short-identifiers",
suspiciousLiteral: "suspicious-literal",
obfuscatedCode: "obfuscated-code"
})
};
2 changes: 0 additions & 2 deletions jest.setup.js

This file was deleted.

Loading

0 comments on commit 863d4ab

Please sign in to comment.