Tool
jsluice
Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.
Requirements & limits
- The project publishes no releases or tags: the README installs the CLI with go install and the package with go get. go.mod declares Go 1.18 and pins go-tree-sitter, goquery, jsbeautifier-go and a WARC reader. The reviewed main commit dates from 2024-01-10; the repository has Go unit tests and JavaScript fixtures but no CI workflow.
- Inputs are JavaScript files, HTML pages whose inline scripts it extracts, WARC archives, raw source on stdin, or http(s) URLs fetched with optional cookies and headers; output is JSONL. The analysis is static: concatenated runtime values appear as EXPR or a chosen placeholder, and the README calls the approach not foolproof, so extracted endpoints are leads to check against the application.
- secrets mode ships active matchers only for AWS, GCP and GitHub key formats and Firebase configuration objects, plus user-supplied JSON pattern files; the README shows that unanchored custom patterns match unintended values. Matches are pattern hits, not confirmed credentials, and this entry records no values found with the tool.
- MIT, copyright 2023 Bishop Fox. Nothing was built or run.
About this entry
- Type
- Tool
- Category
- Website analysis tools
- Relationship
- Foundation tool
- Targets
- Website
Sources reviewed
The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.
Primary sources
- README.mkd GitHub · BishopFox/jsluice · Revision 0ddfab1
- cmd/jsluice/README.mkd GitHub · BishopFox/jsluice · Revision 0ddfab1
- go.mod GitHub · BishopFox/jsluice · Revision 0ddfab1
- analyzer.go#L23-L43 GitHub · BishopFox/jsluice · Revision 0ddfab1
- secret-matchers.go#L91-L98 GitHub · BishopFox/jsluice · Revision 0ddfab1
- cmd/jsluice/main.go GitHub · BishopFox/jsluice · Revision 0ddfab1
- LICENSE GitHub · BishopFox/jsluice · Revision 0ddfab1
More in Websites
- Dinosaur runner: recovering one acceleration rule · Case study
- rauchg.com: rebuilding an RSC blog from captured Flight output · Case study
- BaoCut Slides: adapting an interactive web editor · Case study
- REA in Claude Code: an isolated static-analysis A/B trial · Case study
- Dinosaur runner: an REA-inspected speed rule rebuilt with Codex · Case study
- BaoCut Design: porting reconstructed canvas and design-system editors · Case study