Neptunium, Promethium, Manganese
    Have ideas to improve npm?Join in the discussion! »


    0.1.31 • Public • Published


    Elegant, Fast JavaScript static security analyzer for finding issues like DOM XSS.

    Codeship Status for skepticfx/esflow


    Install esflow as a command line tool (might require sudo permission):

    npm install -g esflow


       esflow -v                     : Prints the current version
       esflow    : Scans for all embedded js code in
       esflow -a : Scans for all embedded js code in and all included js files
       esflow ./                     : Scans all the JS files in the current directory
       esflow ./test.js              : Scans a specific JS file
       esflow -h                     : Show this help menu

    Analyzing your source code

    You can scan a website for its JavaScript code like this:

    $ esflow

    If you want to scan all the script files in the webpage, just add -a at the end.

    $ esflow -a

    You can also use esflow on a specific file or a directory

    esflow fileName.js


    esflow ./

    Extending esflow to write your own sources and sinks

    git clone
    cd esflow
    npm install

    And then use it like this:

    var esflow = require('./index.js');
    // The code to analyze./bin
    var code = require('fs').readFileSync('./inputs/basic.js', 'utf8');
    // Define sources and sinks
    var sources = ['document.cookie', 'location.href', 'location.hash', ''];
    var sinks = ['.innerHTML', '.outerHTML', '$', 'jQuery', 'eval', 'setTimeout', 'document.write'];
    var specialSinks = [{'calleeName': '.setAttribute', 'argumentPosition': 1, 'argumentValue': ['onclick', 'href']}];
    var filters = ['escape', 'encodeURI', 'encodeHTML', 'clean'];
    var result = esflow.analyze(code, {sources: sources, sinks: sinks, specialSinks: specialSinks});

    You can try,

    node runner.js fileName.js to run an analysis on the ./fileName.js file.


    npm test
    npm run testAll

    All tests are under ./test/. Take a look at ./test/assignments.test.js & ./test/functionCalls.test.js and their respective fixtures to get an idea.

    Running benchmarks

    npm run testFiringRange


    • Find DOM XSS for usual coding patterns.
    • Should be easily extensible to any framework like NodeJS, AngularJS, or any X-Library.
    • Should have an approach to specify filters like escape(), encodeURIComponent and custom filter functions. In these cases, do not flag as a vulnerable flow. (TODO)
    • False positives and negatives are common, we try to focus on coding patterns for given frameworks and focus on improving detection for that.
    • Should always complete to end. Do not get stuck in a infinite recursion / stack call, Tail Code Optimize when possible.


    Static analyzers are usually dumb and easily miss a valid vulnerability or report an invalid issue as a vulnerability. Its a island full of false positives and negatives.

    Please file an issue when you see any insanely unexpected results and we can work towards fixing that ASAP, if the issue makes sense.


    npm i esflow

    DownloadsWeekly Downloads






    Last publish


    • avatar