mozilla / scanjs

[DEPRECATED] Static analysis tool for javascript code.
Other
428 stars 39 forks source link

Add 'Export' functionality to print summarized report #127

Closed pwnetrationguru closed 10 years ago

pwnetrationguru commented 10 years ago

Very simple for now, but this functionality allows a user to generate a summarized reports. This is useful for many things, obviously, but we are mainly interested in being able to take a "snapshot" or "fingerprint" of the application's current start during a review.

The outputed report looks similar to:


filename, rule name, line
accessibility.js, setTimeout, [98, 142]
action_menu.js, .innerHTML , [58]
action_menu.js, setTimeout, [92]
activities.js, setTimeout, [54]
airplane_mode.js, setTimeout, [452]
app_chrome.js, setTimeout, [132, 244, 253]
app_install_manager.js, .innerHTML , [307, 313]
app_modal_dialog.js, .innerHTML , [219, 228, 237]
app_window.js, setTimeout, [501, 770, 775, 790, 1318, 1327, 1338]
app_window.js, .href=, [1178]
app_window.js, .src, [1187, 1297, 1301]
attention_screen.js, .bar=, [18]
attention_screen.js, setTimeout, [173, 181, 256, 302]
battery_manager.js, setTimeout, [131]
bluetooth_transfer.js, setTimeout, [294]
bluetooth_transfer.js, .innerHTML , [348]

The report is not generated until a user clicks "Export', so there are no performance implications.

pauljt commented 10 years ago

This is an interesting idea - seems more like a "summary" than an export function, but still seems like it could be useful. However a couple suggestions:

pwnetrationguru commented 10 years ago

This is an interesting idea - seems more like a "summary" than an export function, but still seems like it could be useful.

Yah, I completely agree. This is more to serve as a 'fingerprint' of an application at a given time, so a summary might be more accurate description.

If you think 'fingerprinting' an application isn't very useful, I'd be happy to focus on making this a more meaningful export functionality. @pauljt, what do you think?

mozfreddyb commented 10 years ago

This doesn't merge anymore :/ Would you be willing to fix this still, @pwnetrationguru? :)

pauljt commented 10 years ago

I'd focus on getting some kind of output that can be attached to a wiki or something instead - which is different to the approach prototyped here. As is said above, not sure there is a use case for this at the moment.

mozfreddyb commented 10 years ago

I agree but I also didn't want to close this in case Rob wants to continue working on this. We shouldn't discourage our contributors! ;)

pwnetrationguru commented 10 years ago

Hey!

Just now saw this for some reason, yah I will work on this some more and a wiki markup style output makes more sense to me as well. :)

Nice to see scanjs gaining some github rep! :fist: