explode-js/explode_js.opam at main · formalsec/explode-js · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# This file is generated by dune, edit dune-project instead
opam-version: "2.0"
synopsis: "Automatic Exploit Generation for Node.js Packages"
description:
  "Explode.js is an exploit generation tool for Node.js packages that can automatically synthesize functional exploits for multi-interaction vulnerablitilties. That is, vulnerabilities that require a series of interactions with the vulnerable package to be exploited. Given a vulnerable package, explode-js can identify code injection, command injection, prototype pollution, and path traversal vulnerabilities, and build a JS program that is guaranteed to produce observable side effects, thereby confirming the existence of the vulnerability and eliminating false positives."
maintainer: ["Filipe Marques <filipe.s.marques@tecnico.ulisboa.pt>"]
authors: ["Filipe Marques <filipe.s.marques@tecnico.ulisboa.pt>"]
license: "MIT"
tags: ["symbolic execution" "javascript" "exploit"]
homepage: "https://github.com/explode-js/explode-js"
doc: "https://url/to/documentation"
bug-reports: "https://github.com/explode-js/explode-js/issues"
depends: [
  "bos"
  "cmdliner"
  "dune" {>= "3.20"}
  "dune-site"
  "dune-glob"
  "dune-build-info"
  "ecma-sl" {= "dev"}
  "extunix"
  "ppxlib"
  "ppx_deriving"
  "ppx_deriving_yojson"
  "fpath"
  "mdx" {with-test}
  "ocaml"
  "smtml" {>= "0.25.0"}
  "prelude"
  "yojson"
  "menhir" {build & >= "20220210"}
  "ocamlformat" {>= "0.29.0" & with-dev-setup}
  "odoc" {with-doc}
]
depopts: ["z3" "cvc5"]
build: [
  ["dune" "subst"] {dev}
  [
    "dune"
    "build"
    "-p"
    name
    "-j"
    jobs
    "--promote-install-files=false"
    "@install"
    "@runtest" {with-test}
    "@doc" {with-doc}
  ]
  ["dune" "install" "-p" name "--create-install-files" name]
]
dev-repo: "git+https://github.com/explode-js/explode-js.git"
x-maintenance-intent: ["(latest)"]
pin-depends: [
  [ "ecma-sl.dev" "./vendor/ECMA-SL" ]
]