0.1.31 • Public • Published


Elegant, Fast JavaScript static security analyzer for finding issues like DOM XSS.

Codeship Status for skepticfx/esflow


Install esflow as a command line tool (might require sudo permission):

npm install -g esflow


   esflow -v                     : Prints the current version
   esflow    : Scans for all embedded js code in
   esflow -a : Scans for all embedded js code in and all included js files
   esflow ./                     : Scans all the JS files in the current directory
   esflow ./test.js              : Scans a specific JS file
   esflow -h                     : Show this help menu

Analyzing your source code

You can scan a website for its JavaScript code like this:

$ esflow

If you want to scan all the script files in the webpage, just add -a at the end.

$ esflow -a

You can also use esflow on a specific file or a directory

esflow fileName.js


esflow ./

Extending esflow to write your own sources and sinks

git clone
cd esflow
npm install

And then use it like this:

var esflow = require('./index.js');

// The code to analyze./bin
var code = require('fs').readFileSync('./inputs/basic.js', 'utf8');

// Define sources and sinks
var sources = ['document.cookie', 'location.href', 'location.hash', ''];
var sinks = ['.innerHTML', '.outerHTML', '$', 'jQuery', 'eval', 'setTimeout', 'document.write'];
var specialSinks = [{'calleeName': '.setAttribute', 'argumentPosition': 1, 'argumentValue': ['onclick', 'href']}];
var filters = ['escape', 'encodeURI', 'encodeHTML', 'clean'];

var result = esflow.analyze(code, {sources: sources, sinks: sinks, specialSinks: specialSinks});


You can try,

node runner.js fileName.js to run an analysis on the ./fileName.js file.


npm test
npm run testAll

All tests are under ./test/. Take a look at ./test/assignments.test.js & ./test/functionCalls.test.js and their respective fixtures to get an idea.

Running benchmarks

npm run testFiringRange


  • Find DOM XSS for usual coding patterns.
  • Should be easily extensible to any framework like NodeJS, AngularJS, or any X-Library.
  • Should have an approach to specify filters like escape(), encodeURIComponent and custom filter functions. In these cases, do not flag as a vulnerable flow. (TODO)
  • False positives and negatives are common, we try to focus on coding patterns for given frameworks and focus on improving detection for that.
  • Should always complete to end. Do not get stuck in a infinite recursion / stack call, Tail Code Optimize when possible.


Static analyzers are usually dumb and easily miss a valid vulnerability or report an invalid issue as a vulnerability. Its a island full of false positives and negatives.

Please file an issue when you see any insanely unexpected results and we can work towards fixing that ASAP, if the issue makes sense.

Package Sidebar


npm i esflow

Weekly Downloads






Last publish


  • skepticfx