4

These days, most websites minify & concatenate their code.

Are there techniques to identify open-source libraries within minified, concatenated code?

I'm mostly interested so I can focus analysis on non-library code, but also to spot outdated libraries with vulnerabilities.

(To keep this on topic, I am asking about techniques not tools, but if you happen to incidentally mention a tool, I won't complain)

5
  • What do you mean by “libraries within the code”? There are different ways of loading libraries in JavaScript (script tags, module loaders like RequireJS etc.), but each time, the library should be a separate file, not code embedded into the application code. Or do you want to detect whether a minified file is a library?
    – Ja1024
    Commented Jun 19 at 15:23
  • If you mean concatenation (multiples files are combined), you should add this in your question. Minification doesn't imply that files are concatenated.
    – Ja1024
    Commented Jun 19 at 15:33
  • @Ja1024: But optimal minification (which no one achieves) does
    – Ben Voigt
    Commented Jun 19 at 15:59
  • minification usually just removes white space and linebreaks, but some will also shorten variable names making code much less readable. You should consider ALL javascript code to be open source for security purposes, since it is by nature. (unless obfuscated, but even then...) If someone wanted to hide the code they might use something like web assembly instead. A smart analyzer would probably be able to deal with minified code just fine, even if variable names are shortened. Commented Jun 19 at 20:06
  • @Ja1024 - good point, I have made an edit
    – paj28
    Commented Jun 19 at 20:18

1 Answer 1

4

There are standard approaches for analyzing code similarity in general and for JavaScript in particular. Depending on the exact minifier, it's probably sufficient to look for Type-2 clones (formatting changes and variable renaming). When you've built a database of common JavaScript libraries, you could try a tool like NiCad with the corresponding JavaScript grammar

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .