jsluice

The jsluice repository provides two primary command-line tools:

1. jsluice: The main command-line tool for the jsluice package.
2. jsurls-sinks: A development tool designed to identify locations within JavaScript source code that potentially contain URLs or file paths.

A UserPattern determines its matching strategy based on the fields it populates:

1. Object Matching: If the Object field is populated, it uses objectMatcher(). This requires all patterns defined in the Object slice to match within a single JSON object.
2. Pair Matching: If Key is provided (but Object is empty), it uses pairMatcher(). This matches against key/value pairs within an object and includes the parent object as Context in the resulting Secret.
3. String Matching: If only Value is provided (or neither Key nor Object), it uses stringMatcher(). This matches against raw string literals. If the string is part of a pair, the parent object is included as Context.

When working with JavaScript string nodes, use these methods to handle quotes and escapes:

• RawString() string: Returns the JavaScript representation with surrounding quotes removed, but escape sequences are left undecoded (e.g., "\n" remains "\n").
• DecodedString() string: Returns a fully decoded version of the string (e.g., "\n" becomes an actual newline character).
• IsStringy() bool: Returns true if the node is a string type or an expression that starts with a string delimiter (`

The jsluice tool operates in one of five distinct modes:

• urls: Extracts URLs and paths from assignments, function calls (like fetch, window.open, $.ajax), XMLHttpRequest usage, and string literals.
• secrets: Finds API keys, passwords, and other sensitive data (includes built-in extractors for AWS, GCP, GitHub, and Firebase).
• tree: Prints a textual representation of the JavaScript syntax tree.
• query: Runs Tree-sitter queries against the JavaScript files.
• format: Formats (beautifies) JavaScript source code using jsbeautifier-go.

To install jsluice, you must have Go installed and configured on your system. Run the following command to install the latest version:

go install github.com/BishopFox/jsluice/cmd/jsluice@latest

Use the secrets mode to find sensitive data like API keys. It includes built-in support for AWS, GCP, GitHub, and Firebase.

Custom Secret Matchers: You can provide a JSON file containing custom patterns using the -p/--patterns flag. Each pattern object in the JSON array can include:

• name: The name used in the output.
• severity: One of info, low, medium, or high.
• value: A Go-syntax regular expression to match against string values.
• key: A Go-syntax regular expression to match against key names.
• object: An array of patterns to match against keys and values within an entire object.

Example Pattern File (patterns.json):

[
  {
    "name": "base64",
    "value": "(eyJ|YTo|Tzo|PD[89]|rO0)[%a-zA-Z0-9+/]+={0,2}",
    "severity": "low"
  }
]

Example Usage:

jsluice secrets -p patterns.json simple-b64.js | jq

Use the urls mode to find URLs and paths. jsluice analyzes how values are used (e.g., in fetch calls) rather than just looking at string patterns. By default, complex expressions are replaced with EXPR, but you can customize this with the -P/--placeholder flag.

Key Options for urls mode:

• -I, --ignore-strings: Ignore matches that are just simple string literals.
• -S, --include-source: Include the original source code snippet in the output via a source field.
• -R, --resolve-paths <url>: Resolve relative paths using the provided base URL.

Example:

jsluice urls location.js -I -R https://example.com/~tom/photos/2003/ | jq

The query mode allows you to run Tree-sitter queries against JavaScript files. You must specify a query using the -q/--query flag and identify the capture using the @ syntax.

Key Options for query mode:

• -q, --query <query>: The Tree-sitter query string (e.g., '(string) @str').
• -r, --raw-output: If set, jsluice will not attempt to JSON-encode the query output (useful for getting raw strings).

Example:

jsluice query -q '(string) @str' config.js

The format mode uses jsbeautifier-go to prettify minified or poorly formatted JavaScript code.

Example:

jsluice format testdata/location.min.js

The jsluice command-line tool extracts URLs, paths, secrets, and other interesting bits from JavaScript files using static analysis. It supports local files, remote files via HTTP/HTTPS, and files provided via stdin.

Basic Syntax:

jsluice <mode> [options] [file...]

Input via stdin:

find . -name '*.js' | jsluice <mode> [options]

Output Format: Output is provided in JSONL format. It is recommended to pipe the output to jq for human-readable formatting and filtering.