JavaScript review
Treat the frontend as source. Most P1s on modern apps start here.
Tags: js, recon, xss, secrets
Checklist
- Collect every JS URL: katana -jc, getJS, HTML script src, prefetch, service worker, web workers, JSONP leftovers.
- Grab source maps: sourceMappingURL, same-path .map, _next/static. Restore original files before grepping.
- Index routes and verbs: Fetch paths, axios bases, GraphQL operations, websocket URLs, feature flags.
- Find sinks: innerHTML, html(), v-html, dangerouslySetInnerHTML, document.write, eval, new Function, location, postMessage, window.open.
- Find sources: location, document.referrer, postMessage, storage, URLSearchParams, cookie, window.name.
- Find secrets and tenants: AKIA, Firebase, Stripe, Mapbox, Datadog, environmentKey, appDefinition, client IDs, audience, tenant slugs.
- Find authz assumptions: isAdmin, role, tenantId, organisationId in client state. Anything the UI hides is still an API param.
- postMessage map: Every addEventListener('message') and every postMessage(*, '*'). Origin checks and sinks.