Skip to content

Commit

Permalink
Fixes doyensec#59: Allow running electronegativity programatically
Browse files Browse the repository at this point in the history
  • Loading branch information
baltpeter committed May 7, 2020
1 parent c6973bc commit 30b3b85
Show file tree
Hide file tree
Showing 6 changed files with 583 additions and 42 deletions.
3 changes: 2 additions & 1 deletion .babelrc
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
{
"presets": ["es2015"]
"presets": ["es2015"],
"plugins": ["add-module-exports"]
}
68 changes: 67 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,8 @@ $ npm install @doyensec/electronegativity -g

## Usage

### CLI

```
$ electronegativity -h
```
Expand Down Expand Up @@ -60,6 +62,71 @@ $ electronegativity -i /path/to/electron/app -v -u 7..8

Note: if you're running into the Fatal Error "JavaScript heap out of memory", you can run node using ```node --max-old-space-size=4096 electronegativity -i /path/to/asar/archive -o result.csv```

### Programatically

You can also use electronegativity programatically, using similar options as for the CLI:

```js
const run = require('@doyensec/electronegativity')
// or: import run from '@doyensec/electronegativity';

run({
// input (directory, .js, .html, .asar)
input: '/path/to/electron/app',
// save the results to a file in csv or sarif format (optional)
output: '/path/for/output/file,
// true to save output as sarif, false to save as csv (optional)
isSarif: false,
// only run the specified checks
customScan: ['dangerousfunctionsjscheck', 'remotemodulejscheck'],
// only return findings with the specified level of severity or above (optional)
severitySet: 'high',
// only return findings with the specified level of confidence or above (optional)
confidenceSet: 'certain',
// show relative path for files (optional)
isRelative: false,
// run Electron upgrade checks, eg -u 7..8 to check upgrade from Electron 7 to 8 (optional)
electronUpgrade: '7..8'
})
.then(result => console.log(result))
.catch(err => console.error(err));
```
The result contain the number of global and atomic checks, any errors encountered while parsing and an array of the issues found, like this:
```json
{
globalChecks: 6,
atomicChecks: 36,
errors: [
{
file: 'ts/main/main.ts',
sample: 'shell.openExternal(url);',
location: { line: 328, column: 4 },
id: 'OPEN_EXTERNAL_JS_CHECK',
description: 'Review the use of openExternal',
properties: undefined,
severity: { value: 2, name: 'MEDIUM', format: [Function: format] },
confidence: { value: 0, name: 'TENTATIVE', format: [Function: format] },
manualReview: true,
shortenedURL: 'https://git.io/JeuMC'
},
{
file: 'ts/main/main.ts',
sample: 'const popup = new BrowserWindow(options);',
location: { line: 340, column: 18 },
id: 'CONTEXT_ISOLATION_JS_CHECK',
description: 'Review the use of the contextIsolation option',
properties: undefined,
severity: { value: 3, name: 'HIGH', format: [Function: format] },
confidence: { value: 1, name: 'FIRM', format: [Function: format] },
manualReview: false,
shortenedURL: 'https://git.io/Jeu1p'
}
]
}
```
## Contributing
If you're thinking about contributing to this project, please take a look at our [CONTRIBUTING.md](https://github.com/doyensec/electronegativity/blob/master/CONTRIBUTING.md).
Expand All @@ -73,4 +140,3 @@ This project has been sponsored by [Doyensec LLC](https://www.doyensec.com).
![alt text](https://doyensec.com/images/logo.svg "Doyensec Logo")
[Engage us to break](https://doyensec.com/auditing.html) your Electron.js application!

Loading

0 comments on commit 30b3b85

Please sign in to comment.