[Bug] loading results via json doesn't save line of code about scanjs

[pauljt]

I implemented this but then commented it out because a) its not super just to have the one line, and b) unless you prettify the source, this causes explosions. I think the solution here, if we actually want to solve it is that we are going to have to have an option in the report format to store the scanned js files in their entirety

[pauljt]

PS it was a pretty hacky approach:

scanresults[rule.name].push({
rule : rule,
filename : filename,
line : node.loc.start.line,
col : node.loc.start.col,
node : node
//this adds a snippet based on lines. need to prettify first if going to use this.
//snippet:content.split('\n').splice(node.loc.start.line-1,node.loc.start.line+1).join('\n')

I think better would just be to store the whole js file, and the extract the snippets in the report viewer.

[pwnetrationguru]

That makes sense about needing the JS file to be prettified otherwise extracting a line number will be useless.

Also, I think that makes sense to store the JS files as part of our scan results. We will need to consider how to deal with users that run Scan.js in the console on a directory and then view the results in the client interface; e.g. do we duplicate all the files in the directory, etc.

[mozfreddyb]

But if we prettify things before showing, people won't identify the code we show them as theirs. I'd say the snippet shouldn't be a whole line but just the current node (or 2-3 nodes up for context). We could also strip after X characters, to make sure we don't show too much.

If we expose a meaningful snippet, do we still need the full node in the results?