class

Analyzer::Javascript::SocketIO

Inherits Analyzer::Javascript::JavascriptEngine < Analyzer < FileHelper < Reference < Object

Surfaces Socket.IO real-time attack surface as ws:// endpoints. A Socket.IO server handles inbound client messages via socket.on("event", ...) handlers inside a connection callback; io.of("/namespace") scopes handlers to a namespace. Each inbound event becomes one endpoint ws://<namespace>/<event> (default namespace → ws://<event>), method "SEND", protocol "ws" — so the existing WebsocketTagger tags them. Outbound emit/send calls (server → client) are not attack surface and are ignored.

Per-file line scan (Socket.IO server setup and its handlers are co-located). A namespace cursor tracks which .of("/ns") connection block the current socket.on handlers belong to.

Constants

CONNECTION_HANDLER = /\b(\w+)\.on\(\s*["'](?:connection|connect)["']/

A connection handler on a receiver variable: admin.on("connection".

DELEGATION = /(?<![\w$.])([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(\s*([A-Za-z_$][\w$]*)\s*[,)]/

registerChatHandlers(socket) / generalSocketHandler(socket, server) inside a connection callback: the socket handed to a function whose definition (often in another module) registers the events. Group 1 is the callee as written, group 2 its first argument.

EVENT_HANDLER = /\b(\w+)\.on\(\s*(?:([A-Za-z_$][\w$]*)\s*\+\s*)?["']([^"']+)["']/

Any <recv>.on("event", ...) handler, or <recv>.on(prefix + "event" (the prefix variable is group 2).

MAX_DELEGATION_DEPTH = 3

How many hand-offs to follow (connection → registerAll(socket) → registerChat(socket)).

NS_ASSIGN = /\b(\w+)\s*=\s*\w+\.of\(\s*["']([^"']+)["']/

const admin = io.of("/admin") — binds a variable to a namespace.

NS_INLINE_CONNECTION = /\.of\(\s*["']([^"']+)["']\s*\)\s*\.on\(\s*["'](?:connection|connect)["']/

A connection handler on an inline namespace: io.of("/x").on("connection".

RAW_SOCKET_SERVER = /\b([A-Za-z_$][\w$]*)\s*=\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?(?:createServer|createSocket)\s*\(/

const server = net.createServer(), tls.createServer(opts), dgram.createSocket("udp4"), http.createServer(app): a raw Node server, whose connection sockets emit data and end, not Socket.IO events. Group 1 is the variable.

RESERVED_EVENTS = Set {"connection", "connect", "connect_error", "disconnect", "disconnecting", "error", "new_namespace", "newListener", "removeListener", "ping", "pong", "reconnect", "reconnect_attempt", "reconnect_error", "reconnect_failed", "reconnecting"}

Socket.IO / EventEmitter reserved events that are lifecycle signals, not client-invocable application messages.

SOCKET_PARAM = /\.on\(\s*["'](?:connection|connect)["']\s*,\s*(?:async\s+)?(?:function\s*)?\(?\s*(\w+)/

The socket parameter bound by a connection callback: .on("connection", (socket) => …, … , async function (client) {, etc. Only .on(...) calls on such a bound variable are treated as socket event handlers, so unrelated emitters that co-locate with the server (process.on("SIGTERM"), httpServer.on("error")) don't leak phantom events.

STRING_CONST = /^\s*(?:export\s+)?(const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*["']([^"'\\]*)["']\s*;?\s*$/m

const prefix = "cloudflared_"; (group 1 the keyword).

Class methods

tech_name
Source

Instance methods

analyze
Source
tech

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.

Source

Nested types