rav-xss - npm Package Compare versions

Comparing version 1.0.29 to 1.0.30

package.json

 {
   "name": "rav-xss",
-  "version": "1.0.29",
+  "version": "1.0.30",
   "description": "⚙️ CLI/NPM | RAV XSS | 🎯 Basic Reflected XSS scanner for bug bounty programs.",
@@ -5,0 +5,0 @@ "main": "src/index.js",

src/core/browser.js

@@ -23,2 +23,4 @@ "use strict";
  * via Playwright (Modo Navegador) com detecção automática de ambiente.
+ * Inicializa o navegador com sandbox rigoroso para mitigar riscos de
+ * páginas maliciosas e ataques de supply-chain.
  */
@@ -128,3 +130,5 @@ class BrowserManager {
   /**
-   * 🚀 Inicializa o navegador Playwright
+   * 🚀 Inicializa o navegador Playwright com sandbox reforçado.
+   * Desabilita credenciais de rede e barra downloads para isolar o ambiente
+   * de testes do sistema operacional real, prevenindo impactos de páginas maliciosas.
    * @returns {Promise<Object>} Instância do navegador
@@ -147,3 +151,45 @@ */
         '--disable-setuid-sandbox',
-        '--disable-dev-shm-usage'
+        '--disable-dev-shm-usage',
+        '--disable-web-security',
+        '--disable-features=VizDisplayCompositor',
+        '--disable-background-networking',
+        '--disable-sync',
+        '--disable-default-apps',
+        '--disable-translate',
+        '--disable-extensions',
+        '--disable-plugins',
+        '--disable-popup-blocking',
+        '--disable-prompt-on-repost',
+        '--disable-ipc-flooding-protection',
+        '--disable-hang-monitor',
+        '--disable-client-side-phishing-detection',
+        '--disable-component-update',
+        '--disable-domain-reliability',
+        '--disable-breakpad',
+        '--disable-background-timer-throttling',
+        '--disable-renderer-backgrounding',
+        '--disable-backgrounding-occluded-windows',
+        '--disable-field-trial-config',
+        '--disable-software-rasterizer',
+        '--disable-speech-api',
+        '--disable-print-preview',
+        '--disable-notifications',
+        '--no-default-browser-check',
+        '--no-first-run',
+        '--no-pings',
+        '--no-service-autorun',
+        '--media-cache-size=1',
+        '--disk-cache-size=1',
+        '--aggressive-cache-discard',
+        '--disable-accelerated-2d-canvas',
+        '--disable-gpu',
+        '--disable-reading-from-canvas',
+        '--disable-remote-fonts',
+        '--disable-partial-raster',
+        '--enable-features=NetworkService,NetworkServiceInProcess',
+        '--force-color-profile=srgb',
+        '--metrics-recording-only',
+        '--mute-audio',
+        '--no-experiments',
+        '--no-sandbox-and-elevated'
       ]
@@ -167,3 +213,5 @@ });
   /**
-   * 🌐 Cria um novo contexto de navegação
+   * 🌐 Cria um novo contexto de navegação estritamente isolado.
+   * Desabilita permissões sensíveis e ignora erros HTTPS para evitar
+   * vazamento de informações ou interações maliciosas com o sistema.
    * @returns {Promise<Object>} Contexto do navegador
@@ -176,3 +224,12 @@ */
       userAgent: this.config.scanner.user_agent,
-      ignoreHTTPSErrors: true
+      ignoreHTTPSErrors: true,
+      permissions: [],
+      geolocation: undefined,
+      locale: 'en-US',
+      timezoneId: 'UTC',
+      acceptDownloads: false,
+      bypassCSP: false,
+      extraHTTPHeaders: {
+        'Accept-Language': 'en-US,en;q=0.9'
+      }
     });
@@ -179,0 +236,0 @@ }

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2334831

0.1%

Lines of code

2073

2.83%

Number of low supply chain risk alerts

21

-4.55%

No dependency changes