Git Product home page Git Product logo

gradejs / gradejs Goto Github PK

View Code? Open in Web Editor NEW
402.0 6.0 11.0 3 MB

GradeJS analyzes production Webpack bundles without having access to the source code of a website. Instantly see vulnerabilities, outdated packages, and more just by entering a web application URL.

Home Page: https://gradejs.com

License: MIT License

JavaScript 1.62% HTML 0.24% TypeScript 82.79% SCSS 13.90% Shell 1.46%
javascript webpack security-tools bundling npm package-management bundle vulnerability vulnerability-detection bugbounty

gradejs's Introduction

GradeJS

GradeJS is an open-source project that allows you to analyze webpack production bundles without having access to the source code of a website. It detects a list of bundled NPM libraries and works even for minified or tree-shaken bundles.

It parses the abstract syntax tree from a JavaScript file, detects the webpack bootstrap entities and localizes module boundaries. A webpack-bundled module usually represents either a single file of an NPM library or a subset of concatenated files. By using built-in AST hash functions, GradeJS generates special signatures per each exported entity, which are retrospectively looked up in the pre-made database index by a matching algorithm. The matching algorithm is quite straightforward and based on a probabilistic approach.

Preview Preview

More info:

How to use

Go to the https://gradejs.com/ and enter a site in the https://example.com format. An analysis is performed server-side. Once the bundle is analyzed, the package name, version, size, and relative percentage size of the packages are returned.

Supported bundlers & packages

Current beta version supports webpack from 3 to 5 and have indexed ~3,000 most popular NPM libraries over ~100,000 releases.

Contributing

We value your feedback, please use Discussions for questions and comments. If you encounter any suspicious behavior, false or missing results, please file a new issue. At this stage, we don't expect direct code contributions yet.

gradejs's People

Contributors

ctizen avatar knowable avatar spalt08 avatar zardak avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar

gradejs's Issues

Packages are not being detected when concatenateModules is set to true

Hi, I am a Mobx team member and I'd like to see if GradeJS detects Mobx. This library is listed among the indexed packages.

I've created a brand new create-react-app project and added Mobx there.

As you can see it doesn't detect mobx and mobx-react, but it does detect react, react-dom

To get the build locally clone the repo and run npm run build in the project folder.

I've chosen create-react-app because it uses Webpack internally and it has 3.1+ millions installations per week. So chances that the webpack configuration is screwed up are pretty low. If you want to see the configuration you can run npm run eject script in the project folder.

Since GradeJS currently supports only Webpack 3-5, I checked that the current Webpack version matches this requirement by running npm ls webpack. It shows version 5.72 everywhere:

Screen Shot 2022-04-18 at 16 11 55

The Mobx itself is built using Rollup. Also it is a monorepo in case it matters.

Let me know if you need more details.

Should we use the input with type="url" for the main input?

By using the url type we'll make the keyboard on mobile devices different and not auto-capitalize etc.
We can disable the html form validation with novalidate attribute on the input too so that it doesn't complain when no scheme is provided.
What do you think?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.