{
  "added_at": "2026-10-30",
  "additional_evidence_urls": [
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/cmd/jsluice/README.mkd",
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/go.mod",
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/analyzer.go#L23-L43",
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/secret-matchers.go#L91-L98",
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/cmd/jsluice/main.go",
    "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/LICENSE"
  ],
  "category": "web-analysis",
  "description_en": "Bishop Fox's Go library and command-line tool that parses JavaScript with tree-sitter to recover the endpoints a script calls, judging values by how the code uses them rather than by regular expressions alone. URL extraction follows location assignments, window.open, fetch, XMLHttpRequest and jQuery request calls, keeps the HTTP method, headers and query or body parameters, and stands in a placeholder for values only known at run time. Other modes flag credential-shaped values, print syntax trees, run tree-sitter queries and reformat minified code.",
  "description_zh": "Bishop Fox 推出的 Go 库与命令行工具，借助 tree-sitter 解析 JavaScript，还原脚本所调用的接口地址；它依据代码如何使用某个值来判断，而不仅仅依靠正则表达式。URL 提取会跟踪 location 赋值、window.open、fetch、XMLHttpRequest 和 jQuery 请求调用，保留 HTTP 方法、请求头以及查询或请求体参数，并以占位符代替只有运行时才能确定的值。其他模式可标记形似凭据的值、打印语法树、运行 tree-sitter 查询以及格式化压缩代码。",
  "entry_url": "https://awesomerea.org/resources/jsluice/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/jsluice/",
  "evidence_url": "https://github.com/BishopFox/jsluice/blob/0ddfab153e060a9eeaded4d8669233f7c071e7e4/README.mkd",
  "group": "tools",
  "id": "jsluice",
  "json_url": "https://awesomerea.org/resources/jsluice/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/jsluice/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/jsluice/index.md",
  "name": "jsluice",
  "name_zh": "jsluice JavaScript 静态提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The project publishes no releases or tags: the README installs the CLI with go install and the package with go get. go.mod declares Go 1.18 and pins go-tree-sitter, goquery, jsbeautifier-go and a WARC reader. The reviewed main commit dates from 2024-01-10; the repository has Go unit tests and JavaScript fixtures but no CI workflow.",
    "Inputs are JavaScript files, HTML pages whose inline scripts it extracts, WARC archives, raw source on stdin, or http(s) URLs fetched with optional cookies and headers; output is JSONL. The analysis is static: concatenated runtime values appear as EXPR or a chosen placeholder, and the README calls the approach not foolproof, so extracted endpoints are leads to check against the application.",
    "secrets mode ships active matchers only for AWS, GCP and GitHub key formats and Firebase configuration objects, plus user-supplied JSON pattern files; the README shows that unanchored custom patterns match unintended values. Matches are pattern hits, not confirmed credentials.",
    "MIT, copyright 2023 Bishop Fox."
  ],
  "requirements_zh": [
    "该项目不发布任何版本或标签：README 通过 go install 安装命令行工具，通过 go get 引入软件包。go.mod 声明 Go 1.18，并固定 go-tree-sitter、goquery、jsbeautifier-go 和一个 WARC 读取库的版本。所审阅的 main 提交日期为 2024-01-10；仓库包含 Go 单元测试和 JavaScript 测试样例，但没有 CI 工作流。",
    "输入可以是 JavaScript 文件、会从中提取内联脚本的 HTML 页面、WARC 归档、通过标准输入传入的原始源码，或可附带 Cookie 和请求头抓取的 http(s) URL；输出为 JSONL。分析是静态的：拼接进来的运行时值显示为 EXPR 或自定义占位符，README 也承认这种方法并非万无一失，因此提取出的接口只是需要对照应用核实的线索。",
    "secrets 模式内置的有效匹配器只覆盖 AWS、GCP 和 GitHub 密钥格式以及 Firebase 配置对象，另可加载用户提供的 JSON 模式文件；README 示例表明，未加锚点的自定义模式会匹配到意料之外的值。匹配结果只是模式命中，并非已确认的凭据。",
    "采用 MIT 许可，版权归 Bishop Fox（2023）。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/BishopFox/jsluice",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}