0xTeles / syngql-security

SYNGQL queries for web security analysis

syngql security queries

This repository contains a collection of useful SYNGQL queries that reference interesting functions within JavaScript code.

What is SYNGQL

According SYNGQL developers, YNG is like grep but for JavaScript source code: it searches files for a statement, like a function call with specific arguments, based on syntax rather than text. Or, based on structure rather than format.

Queries

• postMessage
• new URL
• addEventListener
• fetch

postMessage

(call (mem postMessage _))

new URL

(of URL)

fetch

(call fetch)

addEventListener

(call (mem addEventListener _))

References

• https://syng.dev/docs/manual/