How can I identify open-source JavaScript libraries within minified code?

Question

These days, most websites minify & concatenate their code.

Are there techniques to identify open-source libraries within minified, concatenated code?

I'm mostly interested so I can focus analysis on non-library code, but also to spot outdated libraries with vulnerabilities.

(To keep this on topic, I am asking about techniques not tools, but if you happen to incidentally mention a tool, I won't complain)

What do you mean by “libraries within the code”? There are different ways of loading libraries in JavaScript (script tags, module loaders like RequireJS etc.), but each time, the library should be a separate file, not code embedded into the application code. Or do you want to detect whether a minified file is a library? — Ja1024, Commented Jun 19 at 15:23
If you mean concatenation (multiples files are combined), you should add this in your question. Minification doesn't imply that files are concatenated. — Ja1024, Commented Jun 19 at 15:33
@Ja1024: But optimal minification (which no one achieves) does — Ben Voigt, Commented Jun 19 at 15:59
minification usually just removes white space and linebreaks, but some will also shorten variable names making code much less readable. You should consider ALL javascript code to be open source for security purposes, since it is by nature. (unless obfuscated, but even then...) If someone wanted to hide the code they might use something like web assembly instead. A smart analyzer would probably be able to deal with minified code just fine, even if variable names are shortened. — browsermator, Commented Jun 19 at 20:06

Ja1024 · Accepted Answer · 2024-06-19 20:57:57Z

4

There are standard approaches for analyzing code similarity in general and for JavaScript in particular. Depending on the exact minifier, it's probably sufficient to look for Type-2 clones (formatting changes and variable renaming). When you've built a database of common JavaScript libraries, you could try a tool like NiCad with the corresponding JavaScript grammar

answered Jun 19 at 20:57

Ja1024

17.1k2 gold badges45 silver badges53 bronze badges

Add a comment |

1 Answer 1