JS sink/source census toolkit — 10 files, no install step beyond three dependencies.
Download .tgz (24 KB) sinks.sh READMEcurl -sO https://sinks.noxian.io/sinks-toolkit.tgz tar xzf sinks-toolkit.tgz && cd sinks-toolkit ./sinks.sh /path/to/js-corpus census
python3 3.8+ rg apt-get install -y ripgrep js-beautify npm i -g js-beautify # every file:line verb needs it
| maps | unpack .js.map sourcesContent into ./_src — do this first |
| census | which sinks / sources / sanitizers exist, in how many files (the default) |
| show <regex> | context windows around every hit, readable on minified code |
| pair | files holding BOTH a source and an HTML sink |
| gap | missing-guard sweep: every sink call site bucketed CONST / GUARDED / UNGUARDED,
plus the app's own guard vocabulary. --sink nav|html|code|<re>, --guard NAME |
| where <frag> | which chunk holds a module id, symbol or string |
| grep <f> <re> | line-numbered search inside one chunk |
| calls <f> <name> | who invokes or passes this function |
| xref <f> <name> | does it leave the file? module id + export name + importers |
| read <f>:<ln> | print around a line |
| def <f> <name> | jump to a definition, any shape |
| lookup <f> <ln> <name> | which binding of name is live at that line |
gap, grep and show print file:line; that exact token pastes
straight back into read and lookup.<dir>/_pretty/, built on demand.
Never quote a line number off the minified file.sinks.sh the entry point, all verbs getpretty.sh beautified-twin cache guardgap.py gap lookup.py lookup sinkshow.py show xref.py xref callsites.py calls findef.py def prettyread.py read jsgrep.py grep
Paths resolve from the script's own directory, so the folder runs from anywhere. Keep the ten files together.
/opt/sinks/.