mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
c1b7c7c027
* fix(js): stop the scanning spinner on early script-parse errors
htmlquery.Parse and QueryAll failures returned before spin.Stop(), leaving
the "Scanning JavaScript files" spinner running forever on those paths while
every other error branch in the function stops it first.
* fix(js): stop reporting quoted regex-flag literals as endpoints
Quoted regex flag combos like "/gi" or "/su" in ordinary JS (e.g.
str.replace("/gi", x)) matched the root-relative path alternative in
endpointRegex and were reported as endpoints. Denylist the known flag
bigrams by exact match instead of raising minEndpointLen, so real short
endpoints like /v1, /me, /ws still extract normally.
* fix(js): keep supabase findings from other projects on a per-project error
ScanSupabase iterates every JWT found in a script and can discover several
distinct supabase projects. Four error paths inside that loop (reading the
signup response, parsing it, fetching the openapi spec, and a missing
Paths field) returned nil and the whole error, discarding any results
already collected for earlier, successfully scanned projects. Skip the
broken project with continue instead so the scan still returns what it
found.
* test(js): drop flaky wall-clock redos timing probe
go's regexp is re2 and linear by construction; the timing threshold added
only flake under -race load, not coverage. the regex-flag-literal false
positive it sat next to is guarded by TestRegexFlagEndpointsNotReported.
53 lines
1.6 KiB
Go
53 lines
1.6 KiB
Go
package js
|
|
|
|
import (
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestProbe_EndpointFalsePositives(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
content string
|
|
}{
|
|
{"regex literal flags", `str.replace("/gi", x)`},
|
|
{"date format string", `format(d, "dd/mm/yyyy")`},
|
|
{"regex char class", `"[a-z]/g"`},
|
|
{"math expression in string", `"1/2 cup"`},
|
|
{"comment prose", `// see docs at ./foo/bar for details`},
|
|
}
|
|
for _, c := range cases {
|
|
got := ExtractEndpoints(c.content, "https://example.com/app.js")
|
|
t.Logf("%-24s input=%-40q => %v", c.name, c.content, got)
|
|
}
|
|
// log (don't fail) whether the regex-literal FP is present
|
|
got := ExtractEndpoints(`x.replace("/gi", "")`, "https://example.com/a.js")
|
|
found := false
|
|
for _, e := range got {
|
|
if strings.Contains(e, "/gi") {
|
|
found = true
|
|
}
|
|
}
|
|
if found {
|
|
t.Log("CONFIRMED: '/gi' regex-flag literal reported as an endpoint (false positive)")
|
|
} else {
|
|
t.Log("note: /gi not reported")
|
|
}
|
|
}
|
|
|
|
// note: a RE2-backtracking probe was removed here: Go's regexp is RE2 and
|
|
// linear by construction, so a wall-clock timing assertion added only flake
|
|
// under -race load, not coverage.
|
|
|
|
// version/entropy extraction is not in the js pkg; this documents the shape
|
|
// of the aws-secret capture group instead.
|
|
func TestProbe_AwsSecretCaptureGroup(t *testing.T) {
|
|
re := regexp.MustCompile(`\b((?:aws_secret_access_key|aws_secret|secret_key)["']?\s*[:=]\s*["']?)([A-Za-z0-9/+]{40})\b`)
|
|
m := re.FindStringSubmatch(`aws_secret_access_key="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"`)
|
|
if m == nil {
|
|
t.Fatal("no match")
|
|
}
|
|
t.Logf("group2 (reported value) = %q", m[2])
|
|
}
|