denandz/sourcemapper

Extract JavaScript source trees from Sourcemap files

Sourcemapper

Sourcemapper is a bit of golang to parse a sourcemap, as generated by webpack or similar, and spit out the original JavaScript files, recreating the source tree based on the file paths in the sourcemap.

An article explaining its purpose is available here: https://pulsesecurity.co.nz/articles/javascript-from-sourcemaps

Install

If you have a recent version of Go installed:

go install github.com/denandz/sourcemapper@latest

Otherwise you can clone and build:

git clone https://github.com/denandz/sourcemapper
cd sourcemapper
go get
go build

If you are running BlackArch Linux:

pacman -S sourcemapper

Usage

:~$ ./sourcemapper
Usage of ./sourcemapper:
  -header value
    	A header to send with the request, similar to curl's -H. Can be set multiple times, EG: "./sourcemapper --header "Cookie: session=bar" --header "Authorization: blerp"
  -help
    	Show help
  -insecure
    	Ignore invalid TLS certificates
  -jsurl string
    	URL to JavaScript file - cannot be used with url
  -output string
    	Source file output directory - REQUIRED
  -proxy string
    	Proxy URL
  -url string
    	URL or path to the Sourcemap file - cannot be used with jsurl

Extracting SourceMaps from .map URLs or local files

The following example shows sourcemapper reading a .map file from Dockerhub. Note, Dockerhub have since removed this map file so the literal command below will not provide this output any more.

doi@asov:~$ ./sourcemapper -output dhubsrc -url https://hub.docker.com/public/js/client.356c14916fb23f85707f.js.map
[+] Retriving Sourcemap from https://hub.docker.com/public/js/client.356c14916fb23f85707f.js.map
[+] Read 23045027 bytes, parsing JSON
[+] Retrieved Sourcemap with version 3, containing 1828 entries
[+] Writing 9076765 bytes to dhubsrc/webpack:/js/client.356c14916fb23f85707f.js
[+] Writing 1014 bytes to dhubsrc/webpack:/webpack/bootstrap 356c14916fb23f85707f
[+] Writing 3174 bytes to dhubsrc/webpack:/app/scripts/client.js
[+] Writing 281 bytes to dhubsrc/webpack:/~/babel-runtime/helpers/interop-require-default.js
[+] Writing 151 bytes to dhubsrc/webpack:/~/babel-core/polyfill.js
{snip}
[+] Writing 271 bytes to dhubsrc/webpack:/~/rc-tooltip/~/core-js/library/fn/object/set-prototype-of.js
[+] Writing 315 bytes to dhubsrc/webpack:/~/rc-tooltip/~/core-js/library/modules/es6.object.set-prototype-of.js
[+] Writing 1044 bytes to dhubsrc/webpack:/~/rc-tooltip/~/core-js/library/modules/_set-proto.js
[+] Writing 308 bytes to dhubsrc/webpack:/~/rc-tooltip/~/core-js/library/fn/object/create.js
[+] Writing 307 bytes to dhubsrc/webpack:/~/rc-tooltip/~/core-js/library/modules/es6.object.create.js
[+] Writing 360 bytes to dhubsrc/webpack:/~/rc-animate/~/core-js/library/fn/object/define-property.js
[+] Writing 371 bytes to dhubsrc/webpack:/~/rc-animate/~/core-js/library/modules/es6.object.define-property.js
[+] Writing 1041 bytes to dhubsrc/webpack:/~/rc-animate/~/babel-runtime/helpers/createClass.js
[+] done
doi@asov:~$ cd dhubsrc/
doi@asov:~/dhubsrc$ du -hs .
20M     .
doi@asov:~/dhubsrc$ cd webpack\:/
~/         app/       js/        webpack/   (webpack)/
doi@asov:~/dhubsrc$ cd webpack\:/app/scripts/
actions/     components/  middlewares/ reducers/    selectors/   stores/      vendor/
doi@asov:~/dhubsrc$ cd webpack\:/app/scripts/components/

Sourcemapper will download or read the map file at url, and then spit the sources out into the directory defined by output. url can be either an URL, or a path to a map file on disk. Extracting a sourcemap to a file can get around sourcemaps configured with sourceMappingURL=data:application/json;.... base64 blob... by decoding the blob into a file, then passing the file path to sourcemapper. Alternatively, data: URL can be handled by directly parsing the JavaScript file as discussed in the following section.

Extracting SourceMaps directly from JavaScript files

sourcemapper can read a JavaScript file from a URL and try to determine whether a sourcemap reference is present. If it is, sourcemapper will download and parse the sourcemap. Absolute, relative and data: sourcemap references are currently supported. sourcemapper follows the rules outlined in https://tc39.es/source-map-spec/#linking-generated-code.

The following shows an example of an inline sourcemap being parsed by processing the JavaScript file directly:

$ ./sourcemapper -output test -jsurl http://localhost:8080/main.js
024/01/05 18:43:53 [+] Retrieving JavaScript from URL: http://localhost:8080/main.js.
2024/01/05 18:43:53 [.] Found SourceMap in JavaScript body: data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7O0FBQVk7O0FBRVo7O0FBRUE7QUFDQSxtREFBbUQsSUFBSSxTQUFTLE1BQU0sSUFBSTs7QUFFMUU7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQSxDQUFDO0FBQ0Q7QUFDQSxDQUFDOztBQUVEO0FBQ0E7QUFDQSxXQUFXLFFBQVE7QUFDbkIsYUFBYTtBQUNiO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBLHVDQUF1QztBQUN2QztBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsMkRBQTJEO0FBQzNEOztBQUVBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsR0FBRzs7QUFFSDtBQUNBO0FBQ0EsR0FBRzs7QUFFSDtBQUNBOztBQUVBO0FBQ0E7QUFDQSxXQUFXLFFBQVE7QUFDbkI7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBLE9BQU87QUFDUDtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBLE1BQU07Q...
2024/01/05 18:43:53 [+] Retrieving Sourcemap from data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFpbi5qcyIsIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7O0FBQVk7O0FBRVo7O0FBRUE7QUFDQSxtREFBbUQsSUFBSSxTQUFTLE1BQU0sSUFBSTs7QUFFMUU7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQSxDQUFDO0FBQ0Q7QUFDQSxDQUFDOztBQUVEO0FBQ0E7QUFDQSxXQUFXLFFBQVE7QUFDbkIsYUFBYTtBQUNiO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBLHVDQUF1QztBQUN2QztBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsMkRBQTJEO0FBQzNEOztBQUVBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsR0FBRzs7QUFFSDtBQUNBO0FBQ0EsR0FBRzs7QUFFSDtBQUNBOztBQUVBO0FBQ0E7QUFDQSxXQUFXLFFBQVE7QUFDbkI7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBLE9BQU87QUFDUDtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTtBQUNBO0FBQ0E7QUFDQTs7QUFFQTtBQUNBLE1BQU07Q...
2024/01/05 18:43:53 [+] Read 4708918 bytes, parsing JSON.
2024/01/05 18:43:54 [+] Retrieved Sourcemap with version 3, containing 535 entries.
2024/01/05 18:43:54 [+] Writing 4262 bytes to test/webpack:/app/node_modules/ansi-html-community/index.js.
2024/01/05 18:43:54 [+] Writing 40 bytes to test/webpack:/app/node_modules/axios/index.js.

Note: sourcemapper will retrieve any URL referenced as a sourcemap, so a malicious JavaScript file parsed with sourcemapper can force sourcemapper to make a GET request to any URL

sourcemapper's Issues

Support for local source map files

Thank you for the awesome tool. It would be great if there were a feature to use local sourcemap files stored locally.

Example:

sourcemapper -output source -local main.js.map

Support for data URI source map

Sometime the source map is self contained:

...
}();
//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ...

It would be nice if sourcemapper would handle such case automatically.

A workaround currently is:

cat base64.txt | base64 -d > map.json
python3 -m http.server 1337
sourcemapper -url http://localhost:1337/map.json -output main

SVGs are not properly extracted

Hello,

I've found an issue with embedded SVGs - they are broken and inside I see js code (this is an example):

var _path;

var _excluded = ["svgRef", "title"];

function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }

function _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }

function _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }

import React from "react";

var svgArrowBack = function svgArrowBack(_ref) {
  var svgRef = _ref.svgRef,
      title = _ref.title,
      props = _objectWithoutProperties(_ref, _excluded);

  return /*#__PURE__*/React.createElement("svg", _extends({
    width: 16,
    height: 8,
    viewBox: "0 0 16 8",
    fill: "none",
    ref: svgRef
  }, props), title ? /*#__PURE__*/React.createElement("title", null, title) : null, _path || (_path = /*#__PURE__*/React.createElement("path", {
    d: "M3.13 5.22C2.758 4.776 2.368 4.392 1.96 4.068C1.564 3.732 1.144 3.456 0.7 3.24V2.466C1.588 2.01 2.398 1.344 3.13 0.467999H4.516C4.288 1.068 4 1.614 3.652 2.106H13.3V3.582H3.652C3.976 4.05 4.264 4.596 4.516 5.22H3.13Z",
    fill: "black"
  })));
};

var ForwardRef = /*#__PURE__*/React.forwardRef(function (props, ref) {
  return /*#__PURE__*/React.createElement(svgArrowBack, _extends({
    svgRef: ref
  }, props));
});
export default __webpack_public_path__ + "static/media/arrow_back.fg3125e2.svg";
export { ForwardRef as ReactComponent };

Is it expected behaviour?

invalid character '/' looking for beginning of value

This tool is not able to Parse a Valid JSON File that is parsed by any online json viewer tool perfectly.

Hello There,

I was trying to use this tool to extract the original source code from the SourceMap File, but when I loaded this tool and give this a sourcemap url, its giving the error while it should parse this json, as the json is perfect.
Here is the snapshot, kindly have a look and fix this issue as soon as possible.

The Source Map URL that is not loading properly in this tool is :
https://www.subway.com/dist/RemoteOrder/js/components/customizer/index.js.map

Thanks & Regards
Tanuj Sharma

sourceMap URL request return != 200

even if sourcemap exist here but it showed non 200 status, why ?

sourcemapper -output srcc -url https://www.carrefour.fr/js/users-rating.7a441ab84b1aaa5e3943.js.map
[+] Retrieving Sourcemap from https://www.carrefour.fr/js/users-rating.7a441ab84b1aaa5e3943.js.map.
sourceMap URL request return != 200

Is there any way to compress everything to one file / minifying to one file again?

I want to modify a script then make it one file again basically

I dont know what to do about this error?

2023/09/04 13:06:34 [+] Retrieving Sourcemap from https://hub.docker.com/public/js/core.c68661edc8.js.map.
2023/09/04 13:06:35 [+] Read 2359 bytes, parsing JSON.
2023/09/04 13:06:35 [!] Error parsing JSON - confirm https://hub.docker.com/public/js/core.c68661edc8.js.map a valid JS sourcemap
2023/09/04 13:06:35 invalid character '<' looking for beginning of value

//# sourceMappingURL=https://sourcemaps.d.musta.ch/airbnb/static/packages/web/common/frontend/hyperloop-browser/core.c68661edc8.js.map maybe it is a self closed source map hard to obtain publically