NodeSecure / js-x-ray

JavaScript & Node.js open-source SAST scanner. A static analyser for detecting most common malicious patterns 🔬.
MIT License
229 stars 26 forks source link

Customizable SourceParser #214

Closed fraxken closed 9 months ago

fraxken commented 9 months ago

The goal of the task is to be able to provide a custom SourceParser to the runASTAnalysis function (if not provided it will take the default JsSourceParser for example).

The idea behind that is to allow anyone to extend/add a new Parsing mechanism (to support TypeScript source for example).

In my mind I see two build-in class:

https://github.com/NodeSecure/js-x-ray/blob/d26eafcf92d8da424bdf7cfdcbc590045d8527ee/src/SourceParser.js#L18-L36

https://github.com/NodeSecure/js-x-ray/blob/master/src/SourceParser.js#L50

If someone want to re-implement his own, it would look like this;

import { SourceParser, runASTAnalysis } from "@nodesecure/js-x-ray";
import { parse } from '@typescript-eslint/typescript-estree';

export class TsSourceParser extends SourceParser {
  parseScript() {
    const ast = parse(this.source, {});

    return ast;
  }
}

const { warnings, dependencies } = runASTAnalysis(
  readFileSync("./file.ts", "utf-8"),
  {
    sourceParser: TsSourceParser
  }
);