From 8748df8a30b038e429aeeff1684e1014f42a68ee Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Thu, 27 Aug 2026 21:21:00 +0200
Subject: Third plugin: jslibscan, a Retire.js-style passive JS library scanner

The first purely passive plugin in the reference set: subscribe,
inspect a response body already captured by ordinary proxying, tag -
no repeat calls at all, unlike authcheck and paramminer. Deliberately
included as the safest possible plugin to try first, since it never
sends anything of its own.

Checks any JS library version string found in a response against a
small, explicitly-illustrative built-in table (jQuery, Lodash,
Handlebars, Moment.js, AngularJS - one well-known vulnerable-version
threshold each), tagging a match jslibscan:hit with the version found,
the fix version, and a plain-language advisory. Not a maintained
vulnerability feed the way real Retire.js's database is, and says so
in its own package doc; CVE numbers deliberately omitted in favor of
describing the vulnerability class, rather than asserting a specific
identifier this reference implementation hasn't independently verified.

Found and fixed a real regex bug by testing live rather than trusting
the code: the first version failed to match jQuery's own actual banner
comment ("jQuery v1.8.3") because the separator pattern only allowed a
single character between library name and version digits, and that
banner has two (space, then "v"). Fixed with a bounded non-greedy gap
verified against three real-world version-string shapes at once
(banner comment, minified filename, cache-busting query string) before
going back into the plugin.

Verified live end to end: a real daemon, a real origin serving both an
outdated jQuery 1.8.3 banner and a current 3.7.1 one - the outdated
file was correctly tagged with the right version and threshold, the
current one correctly left alone. The same run incidentally
reconfirmed the regex fix was real: an entry captured moments earlier
against the buggy binary sat right next to the correctly-tagged one,
itself untagged.
---
 PLUGINS.md | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

(limited to 'PLUGINS.md')

diff --git a/PLUGINS.md b/PLUGINS.md
index d6c0ee9..69961d3 100644
--- a/PLUGINS.md
+++ b/PLUGINS.md
@@ -11,16 +11,21 @@ Go), and means a plugin can be developed and tested against the exact
 same socket the TUI is already using, with `mitmux` itself open in
 another terminal watching what happens in real time.
 
-`plugins/authcheck` and `plugins/paramminer` are real, working
-reference implementations - an Autorize-style authorization checker
-(resends a captured request with its auth header stripped, tags the
-entry if the response still succeeds) and a Param Miner-style hidden
-parameter prober (probes a small wordlist of candidate query
-parameters, tags the entry if any noticeably change the response) -
-both written to only ever exercise what's documented on this page, not
-any of mitmux's own internal Go packages, specifically so they prove
-this protocol is sufficient on its own. Worth reading alongside this
-document, or just copying as a starting point.
+`plugins/authcheck`, `plugins/paramminer`, and `plugins/jslibscan` are
+real, working reference implementations - an Autorize-style
+authorization checker (resends a captured request with its auth header
+stripped, tags the entry if the response still succeeds), a Param
+Miner-style hidden parameter prober (probes a small wordlist of
+candidate query parameters, tags the entry if any noticeably change the
+response), and a Retire.js-style passive scanner for known-vulnerable
+JS library versions (reads response bodies already captured by ordinary
+proxying, no probing at all) - all written to only ever exercise what's
+documented on this page, not any of mitmux's own internal Go packages,
+specifically so they prove this protocol is sufficient on its own.
+Worth reading alongside this document, or just copying as a starting
+point. `jslibscan` in particular is the simplest possible plugin shape
+- subscribe, inspect, tag, nothing else - worth starting from if a
+plugin idea doesn't need to send any traffic of its own.
 
 ## Connecting
 
-- 
cgit v1.2.3