unwebpack-sourcemap - GitLite

KO | EN

gitlite — search

#javascript #python #react #ai #typescript #go #deep-learning #docker #nodejs #windows #cli #ios #openai #open-source

unwebpack-sourcemap

(★ 545)

Extract uncompiled, uncompressed SPA code from Webpack source maps.

File Explorer

Download Latest Version (.zip)

- - jest.json
  - jest.preprocessor.js
- - index.html.ejs
  - index.tsx
- - App.test.tsx
- .babelrc
- .gitignore
- express.js
- LICENSE
- package-lock.json
- package.json
- README.md
- tsconfig.json
- tslint.json
.gitignore
LICENSE
README.md
requirements.txt
unwebpack_sourcemap.py

# Installation Guide

1. Get the code

git clone https://github.com/rarecoil/unwebpack-sourcemap

Downloads the entire project code from GitHub to your computer.

cd unwebpack-sourcemap

Moves into the project folder you just downloaded.

2. Node.js

Easy Recommended

Prerequisites

Git Needed to download the project code from GitHub.
Node.js Node.js must be installed to use npm. The LTS version is recommended.

cd example-react-ts-app

This project's files live in a subfolder, so move into it first.

npm install

Downloads and installs the libraries listed in package.json.

npm start

Starts the development/run server.

✅ After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.

3. Python

Easy

Prerequisites

Git Needed to download the project code from GitHub.
Python 3 On Windows, be sure to check 'Add Python to PATH' during installation.

pip install -r requirements.txt

Installs the Python libraries listed in requirements.txt (or similar).

python <실행할 파일명>.py # README에서 정확한 실행 파일명을 확인하세요

Runs the Python script (or module).

✅ If it runs without errors and prints output in the terminal, it worked.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# unwebpack-sourcemap

# Archive Notice (April 15 2022)

This script seems to be helpful for many, but unfortunately I also do not have time to maintain it and properly code review the work of potential contributors. I'll leave it in an archived state for a while for anyone that wants to fork it, but I will eventually delete this repository.

### Recover uncompiled TypeScript sources, JSX, and more from Webpack sourcemaps.

As single-page applications take over the world, more and more is being asked of the browser as a client. It is common for SPAs to use [Webpack](https://webpack.js.org/) to handle browser script build processes. Usually, Webpack will transpile React/Vue/TypeScript/etc. to JavaScript, minify/compress it, and then serve it as a single bundle to the application.

However, Webpack also produces [JavaScript source maps](https://www.html5rocks.com/en/tutorials/developertools/sourcemaps/) to assist in the debugging and development process; when things go wrong, the browser's debugger can use the SourceMap to point to a line in the code that contains the issue at hand. Most developers do not adequately protect the source maps and ship them to production environments.

When the browser was simply handling an array of JavaScript files concatenated and (maybe) packed, this wasn't so much of an issue. However, developers of SPAs assume the use of JavaScript as an **intermediate representation**. Developers often expect production to contain obfuscated and/or otherwise-processed scripts, and do not understand just what the sourcemaps contain in many cases. This model aligns closely with shipping binaries: source is compiled and you ship the interpretable version. If this is the case, the sourcemap is akin to leaking your source alongside the "binary" (bundle) you have made. The bundle can be reverse engineered just as a binary can, but sourcemaps make this far easier.

## Usage

The script requires Python3, `BeautifulSoup4` and `requests`. Install dependencies with `pip3 install -r requirements.txt`. The script can handle downloaded sourcemaps, or attempt to parse them from remote sources for you. In all of these cases, we will assume that you have a directory you have created called `output` alongside the script:

```
\$ mkdir output
```

In order of increasing noisiness, to unpack a local sourcemap:

```
\$ ./unwebpack_sourcemap.py --local /path/to/source.map output
```

To unpack a remote sourcemap:

```
\$ ./unwebpack_sourcemap.py https://pathto.example.com/source.map output
```

To attempt to read all `<script src>` on an HTML page, fetch JS assets, look for `sourceMappingURI`, and pull sourcemaps from remote sources:

```
\$ ./unwebpack_sourcemap.py --detect https://pathto.example.com/spa_root/ output
```

## I'm a developer and this scares me. What do?

You have a few options:

1. Turn off sourcemaps in production entirely.
1. Push sourcemaps to a private server, and ACL sourcemap URIs to developers only.
1. Load sourcemaps from local sources only and do not push them to production.

## Example Vulnerable Application

An example TypeScript+React application is included in `example-react-ts-app`. You can run this locally and run the script against it.

## Contributions

This is an alpha-level script built for a series of engagements I was working on in which sourcemaps are disclosed in production environments. It currently is only meant to work with TypeScript+React and TypeScript+Vue templates. Pull requests to harden the script, make it read more sourcemaps, et cetera are greatly appreciated.

## License

MIT.