{
  "added_at": "2026-10-30",
  "additional_evidence_urls": [
    "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md#L124",
    "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/main.go#L22-L28",
    "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/main.go#L290-L327",
    "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/go.mod",
    "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/LICENSE",
    "https://pulsesecurity.co.nz/articles/javascript-from-sourcemaps"
  ],
  "category": "web-analysis",
  "description_en": "Go command-line tool that recreates a web front end's original JavaScript source tree from a source map generated by webpack or a similar bundler, writing each embedded source file under the path the map records. It takes a .map file by URL or local path, walks a directory of .map files, or fetches a JavaScript file and follows its sourceMappingURL comment or SourceMap response header, including inline data: maps.",
  "description_zh": "Go 编写的命令行工具，可根据 webpack 等打包工具生成的源映射（source map）重建网站前端原有的 JavaScript 源码目录树，并把映射中内嵌的每个源文件写到其记录的路径下。它可通过 URL 或本地路径读取 .map 文件，递归处理整个目录中的 .map 文件，也可抓取 JavaScript 文件并跟随其中的 sourceMappingURL 注释或 SourceMap 响应头，内联的 data: 映射同样支持。",
  "entry_url": "https://awesomerea.org/resources/sourcemapper/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/sourcemapper/",
  "evidence_url": "https://github.com/denandz/sourcemapper/blob/f739bd5dd266b0d0e2cfa17c0a132f79bd9a5ba9/README.md",
  "group": "tools",
  "id": "sourcemapper",
  "json_url": "https://awesomerea.org/resources/sourcemapper/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/sourcemapper/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/sourcemapper/index.md",
  "name": "sourcemapper",
  "name_zh": "sourcemapper 源映射源码还原工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The project publishes no releases or tags. The README installs it with go install, a clone-and-build, or the BlackArch package; go.mod declares Go 1.16 and lists no third-party modules. The reviewed master commit, dated 2026-07-24, also adds the -dir batch mode and refuses to read a local path named by a remote sourceMappingURL.",
    "Only one of -url, -jsurl or -dir is accepted per run, and -output is required. Remote fetches can carry extra request headers, go through a proxy or skip TLS verification. The README warns that a JavaScript file parsed with -jsurl can make sourcemapper send a GET request to any URL it names as its source map.",
    "The input is a source map the user may inspect. The tool reads only the map's version, sources and sourcesContent fields, so maps without embedded sourcesContent are rejected and minified bundles without a map are out of scope; the mappings are not used, and output is the bundler's captured source text, not code verified against the deployed bundle.",
    "BSD-3-Clause. Recovered front-end code remains subject to the site owner's rights. The README links a 2018 Pulse Security article describing its use for front-end source review in a penetration test."
  ],
  "requirements_zh": [
    "该项目不发布任何版本或标签。README 给出的安装方式为 go install、克隆后自行构建或使用 BlackArch 软件包；go.mod 声明 Go 1.16，且不依赖任何第三方模块。所审阅的 master 提交日期为 2026-07-24，该版本还加入了 -dir 批量模式，并拒绝读取远程 sourceMappingURL 所指向的本地路径。",
    "每次运行只能指定 -url、-jsurl 或 -dir 之一，且必须给出 -output。远程抓取时可附加请求头、经由代理或跳过 TLS 证书校验。README 提醒，使用 -jsurl 解析的 JavaScript 文件可让 sourcemapper 向其声明为源映射的任意 URL 发出 GET 请求。",
    "输入应为使用者有权查看的源映射。工具只读取映射中的 version、sources 和 sourcesContent 字段，因此未内嵌 sourcesContent 的映射会被拒绝，没有映射的压缩代码也不在其处理范围内；它不使用 mappings 字段，输出的是打包工具当时记录的源码文本，并未与线上部署的打包产物核对。",
    "采用 BSD-3-Clause 许可。还原出的前端代码仍受网站所有者的权利约束。README 链接了 Pulse Security 2018 年的一篇文章，介绍在渗透测试中借助它审查前端源码的用法。"
  ],
  "targets": [
    "website"
  ],
  "url": "https://github.com/denandz/sourcemapper",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}