Merge pull request #353 from CybercentreCanada/id_js_2

Adding weak indicators for JavaScript
CybercentreCanada · Sep 8, 2021 · 76d80e0 · 76d80e0
2 parents 94d4f3c + 173289e
commit 76d80e0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/assemblyline/common/identify.py b/assemblyline/common/identify.py
@@ -142,6 +142,7 @@
                         rb'Math\.(round|pow|sin|cos)\(',
                         rb'(isNaN|isFinite|parseInt|parseFloat)\(',
                         b'WSH',
+                        rb'(document|window)\['
                         ],
     'code/jscript': [rb'new[ \t]+ActiveXObject\(', rb'Scripting\.Dictionary'],
     'code/pdfjs': [rb'xfa\.((resolve|create)Node|datasets|form)', rb'\.oneOfChild'],

diff --git a/test/test_identify.py b/test/test_identify.py
@@ -355,6 +355,8 @@ def test_strong_indicators(code_snippet, code_types):
         (b"parseInt(", ["code/javascript"]),
         (b"parseFloat(", ["code/javascript"]),
         (b"WSH", ["code/javascript", "code/vbs"]),
+        (b"document[", ["code/javascript"]),
+        (b"window[", ["code/javascript"]),
         # JScript
         (b"new ActiveXObject(", ["code/jscript"]),
         (b"new\tActiveXObject(", ["code/jscript"]),