class
Analyzer::Javascript::SocketIO
Overview
Surfaces Socket.IO real-time attack surface as ws:// endpoints. A
Socket.IO server handles inbound client messages via
socket.on("event", ...) handlers inside a connection callback;
io.of("/namespace") scopes handlers to a namespace. Each inbound
event becomes one endpoint ws://<namespace>/<event> (default
namespace → ws://<event>), method "SEND", protocol "ws" — so the
existing WebsocketTagger tags them. Outbound emit/send calls
(server → client) are not attack surface and are ignored.
Per-file line scan (Socket.IO server setup and its handlers are
co-located). A namespace cursor tracks which .of("/ns") connection
block the current socket.on handlers belong to.
Defined in:
analyzer/analyzers/javascript/socketio.crConstant Summary
-
CONNECTION_HANDLER =
/\b(\w+)\.on\(\s*["'](?:connection|connect)["']/ -
A connection handler on a receiver variable:
admin.on("connection". -
EVENT_HANDLER =
/\b(\w+)\.on\(\s*["']([^"']+)["']/ -
Any
<recv>.on("event", ...)handler. -
NS_ASSIGN =
/\b(\w+)\s*=\s*\w+\.of\(\s*["']([^"']+)["']/ -
const admin = io.of("/admin")— binds a variable to a namespace. -
NS_INLINE_CONNECTION =
/\.of\(\s*["']([^"']+)["']\s*\)\s*\.on\(\s*["'](?:connection|connect)["']/ -
A connection handler on an inline namespace:
io.of("/x").on("connection". -
RESERVED_EVENTS =
Set {"connection", "connect", "connect_error", "disconnect", "disconnecting", "error", "new_namespace", "newListener", "removeListener", "ping", "pong", "reconnect", "reconnect_attempt", "reconnect_error", "reconnect_failed", "reconnecting"} -
Socket.IO / EventEmitter reserved events that are lifecycle signals, not client-invocable application messages.
-
SOCKET_PARAM =
/\.on\(\s*["'](?:connection|connect)["']\s*,\s*(?:async\s+)?(?:function\s*)?\(?\s*(\w+)/ -
The socket parameter bound by a connection callback:
.on("connection", (socket) => …,… , async function (client) {, etc. Only.on(...)calls on such a bound variable are treated as socket event handlers, so unrelated emitters that co-locate with the server (process.on("SIGTERM"),httpServer.on("error")) don't leak phantom events.