war-and-code / libreveal.js Goto Github PK

Noticed on a recent engagement that target was using extjs but libreveal.js printed just the version number. In lieu of the expected libreveal.js: extjs @ <version here>

Quick glance looks like for whatever reason there's conditional logic in the console.log calls.

This issue covers investigation and fixing of the bug.

(See title)

Ultimately I foresee libreveal.js being derived from the regular RetireJS JSON with an additional JSON file for some additions not in there (i.e. Bootstrap).

You should just be able to run like compile.py which would...

1. Grab the latest of the RetireJS file
2. Get all the function identifiers for libraries that are in there
3. Look in some local jsrepository.json for additional ones
4. Automatically write out libreveal.js with an incremented version number
5. Use some "minifier" to additionally write out libreveal.min.js
6. Output the result of what happened as JSON to make this all automation-friendly

This would take us to version 2.0 where little issues like #1 (assuming that truly comes from RetireJS) are irrelevant.

On a recent pen test, I found the tooltip identifier function for Bootstrap wasn't working.

I am not quite sure why that was but ended up looking at the source to find alternatives. One of these did work.

$.fn.alert.Constructor.VERSION
$.fn.button.Constructor.VERSION
$.fn.carousel.Constructor.VERSION
$.fn.collapse.Constructor.VERSION
$.fn.dropdown.Constructor.VERSION
$.fn.modal.Constructor.VERSION
$.fn.tooltip.Constructor.VERSION
$.fn.popover.Constructor.VERSION
$.fn.scrollspy.Constructor.VERSION
$.fn.tab.Constructor.VERSION
$.fn.affix.Constructor.VERSION

Blocked by #2

When this is "compiling" JavaScript via src/compile.py, there should be some "sanity-checking" on the output.

Looks like this would be made possible by adding a requirement (there will be a requirements.txt now)

pip install pyjsparser

Then parse the script and check for an exception like so...

import pyjsparser

try:
    pyjsparser.parse(output_javascript)
except:
    print('Your JavaScript sucks')

YUI.version

(I think this came from retire.js but just found it in an old assessment notes file)