Skip to content
[DEPRECATED] Static analysis tool for javascript code.
JavaScript CSS HTML Shell
Branch: master
Clone or download
This branch is 78 commits ahead, 1 commit behind pauljt:master.

Latest commit

Fetching latest commit…
Cannot retrieve the latest commit at this time.


Type Name Latest commit message Commit time
Failed to load latest commit information.


Development of ScanJS has stopped. We are currently investigating the use of ESLint with some additional rules. Please see eslint-config-scanjs.

Testing and feedback appreciated! :)


ScanJS is a Static analysis tool for javascript code. ScanJS was created as an aid for security review, to help identify security issues in client-side web applications.

ScanJS uses Acorn to convert sources to AST, then walks AST looking for source patterns. Use the rules file supplied, or load your own rules.

ScanJS Rules

Rules are specified in JSON format - for an example see /common/template_rules.json

At a minimum, each must have rule is made up of 2 attributes:

  • name: the name of the rule
  • source: javascript source which matches one of the patterns below (see Rule Syntax below)

Optionally a rule may have the following attirbutes:

  • testhit: one more JavaScript statements (seperate by semi-colons) that the rule will match
  • testmiss: the rule should not match any of these statements
  • desc: description of the rule
  • threat: for catgorizing rules by threat

Rule Syntax

For the source attribute, the following basic statements are supported:

  • identifier foo: matches any identifier , "foo"
  • property $ $_any is wildcard, matches
  • objectproperty matches object and property, i.e.

You can also matches function calls based on the same syntax:

  • call foo(): matches function calls with this name
  • propertycall $ matches but not foo()
  • objectpropertycall: matches only

You can also search for functions with matching literal arguments:

  • callargs foo('test',ignored,42): matches a function called foo, with 'test' as the first argument, anything as the second argument, and the number 42 as the third argument (i.e. matches ONLY literal arguments).
  • propertycallargs $'test',ignored,42): same as above, but function has to be a property.
  • objectpropertycallargs'test',ignored,42): same as above, but matches both object and property

You can also search for assignment to a specifically named identifier:

  • assignment foo=$_any: matches when foo is assigned to something
  • propertyassignment $$_any: matches when is assigned to something
  • objectpropertyassignment$_any: matches when is assigned to something

If you specify $_unsafe on the right hand side (e.g. foo.innerHTML=$_unsafe), it will only match if the RHS contains at least one identifier.


  • Javascript is very dynamic, and this is navie approach: write conservative rules and review for false positives
  • One simple statement per rule, not complex statements (yet)!
  • 'foo' does NOT match '', if you are looking for something in global (e.g. 'alert()' ), you need to add two rules: 'alert.()' and '$_any.alert()'
  • Try the rule out in the experiment tab to test what it matches

Examples: See /common/template_rules.json and /common/rules.json

Running ScanJS

Run ScanJS in the browser

Run ScanJS from the command line

  • Install node.js
  • scanner.js -t DIRECTORY_PATH

Testing instructions

Tests use the mocha testing framework.

  • npm test
  • or in the browser:

Tests are included in the rules declaration (see common/rules.json) by specifying the following two attributes, which are specified in the form of a series of javascript statements:

  • testhit: The rule should match each of these statements individualy.
  • testmiss: The rule should not match all of these statements.
You can’t perform that action at this time.