class

Analyzer::Javascript::SocketIO

Inherits Analyzer::Javascript::JavascriptEngine < Analyzer < FileHelper < Reference < Object

Surfaces Socket.IO real-time attack surface as ws:// endpoints. A Socket.IO server handles inbound client messages via socket.on("event", ...) handlers inside a connection callback; io.of("/namespace") scopes handlers to a namespace. Each inbound event becomes one endpoint ws://<namespace>/<event> (default namespace → ws://<event>), method "SEND", protocol "ws" — so the existing WebsocketTagger tags them. Outbound emit/send calls (server → client) are not attack surface and are ignored.

Per-file line scan (Socket.IO server setup and its handlers are co-located). A namespace cursor tracks which .of("/ns") connection block the current socket.on handlers belong to.

Constants

CONNECTION_HANDLER = /\b(\w+)\.on\(\s*["'](?:connection|connect)["']/

A connection handler on a receiver variable: admin.on("connection".

EVENT_HANDLER = /\b(\w+)\.on\(\s*["']([^"']+)["']/

Any <recv>.on("event", ...) handler.

NS_ASSIGN = /\b(\w+)\s*=\s*\w+\.of\(\s*["']([^"']+)["']/

const admin = io.of("/admin") — binds a variable to a namespace.

NS_INLINE_CONNECTION = /\.of\(\s*["']([^"']+)["']\s*\)\s*\.on\(\s*["'](?:connection|connect)["']/

A connection handler on an inline namespace: io.of("/x").on("connection".

RESERVED_EVENTS = Set {"connection", "connect", "connect_error", "disconnect", "disconnecting", "error", "new_namespace", "newListener", "removeListener", "ping", "pong", "reconnect", "reconnect_attempt", "reconnect_error", "reconnect_failed", "reconnecting"}

Socket.IO / EventEmitter reserved events that are lifecycle signals, not client-invocable application messages.

SOCKET_PARAM = /\.on\(\s*["'](?:connection|connect)["']\s*,\s*(?:async\s+)?(?:function\s*)?\(?\s*(\w+)/

The socket parameter bound by a connection callback: .on("connection", (socket) => …, … , async function (client) {, etc. Only .on(...) calls on such a bound variable are treated as socket event handlers, so unrelated emitters that co-locate with the server (process.on("SIGTERM"), httpServer.on("error")) don't leak phantom events.

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source