Skip to content

feat(frameworks): add detectors for ~65 additional cms, frontend, backend and hosting platforms #363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TBX3D wants to merge 10 commits into
base: main
Choose a base branch
from
Open

feat(frameworks): add detectors for ~65 additional cms, frontend, backend and hosting platforms #363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c1eca47
fix(frameworks): scope header markers to stop bare-brand false positives
TBX3D Jun 26, 2026
a3be050
fix(frameworks): tighten alpine and flarum against substrings
TBX3D Jun 26, 2026
9091cee
feat(frameworks): add 8 hosting and edge platform detectors
TBX3D Jun 26, 2026
217de13
feat(frameworks): add 5 framework detectors
TBX3D Jun 26, 2026
6b57827
feat(frameworks): add 6 framework detectors
TBX3D Jun 26, 2026
1a0ecd5
feat(frameworks): add 10 framework detectors
TBX3D Jun 26, 2026
e9a6bed
feat(frameworks): add 23 framework detectors
TBX3D Jun 25, 2026
6c0bc33
fix(frameworks): tighten cakephp and strapi against prose
TBX3D Jun 25, 2026
82cc60b
fix(frameworks): tighten stimulus and symfony against solo false posi…
TBX3D Jul 10, 2026
2c432ab
chore(frameworks): trim tautological detector doc comments
TBX3D Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 29 additions & 8 deletions internal/scan/frameworks/detect_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -709,8 +709,25 @@ func TestDetectorRegistry(t *testing.T) {
t.Fatal("expected registered detectors, got none")
}

// Check that some expected detectors are registered
expectedDetectors := []string{"Laravel", "Django", "React", "Vue.js", "Angular", "Next.js", "WordPress", "Astro"}
// Check that expected detectors are registered: a spot-check of the
// originals plus every detector added to the backend, cms, and meta sets.
expectedDetectors := []string{
"Laravel", "Django", "React", "Vue.js", "Angular", "Next.js", "WordPress", "Astro",
"Tornado", "CherryPy", "Play Framework", "Sails.js", "Beego",
"JavaServer Faces", "Google Web Toolkit", "Vaadin", "ColdFusion",
"TYPO3", "Contao", "Wix", "Webflow", "HubSpot", "PrestaShop",
"Sitecore", "OpenCart", "DotNetNuke", "Liferay",
"Hugo", "Jekyll", "Docusaurus", "MkDocs",
"Alpine.js", "Qwik", "jQuery",
"Squarespace", "WooCommerce", "Craft CMS", "Concrete CMS", "Bitrix", "Blogger",
"Eleventy", "Hexo", "VuePress", "Sphinx",
"MediaWiki", "Discourse", "XenForo", "Moodle", "Plone", "Grav",
"Textpattern", "October CMS", "Statamic", "Livewire",
"Stimulus", "Turbo", "Knockout.js", "Unpoly", "Flarum", "NodeBB",
"XWiki", "Bolt CMS", "Nikola", "Publii", "ExpressionEngine",
"Vercel", "Netlify", "GitHub Pages", "Cloudflare",
"Amazon CloudFront", "Akamai", "Fly.io", "Amazon S3",
}
for _, name := range expectedDetectors {
if _, ok := frameworks.GetDetector(name); !ok {
t.Errorf("expected detector %q to be registered", name)
Expand Down Expand Up @@ -842,8 +859,9 @@ func TestDetectFramework_Backbone(t *testing.T) {
func TestDetectFramework_CakePHPFalsePositive(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte(`<!DOCTYPE html><html><body><p>our cupcake and cheesecake recipes,
plus the best pancake stack in town.</p></body></html>`))
// a Q&A/listicle page that merely names the framework, as on the live
// stackoverflow homepage that the bare body substring used to misfire on
w.Write([]byte(`<!DOCTYPE html><html><body><a href="/questions/tagged/cakephp">cakephp</a></body></html>`))
}))
defer server.Close()

Expand All @@ -852,7 +870,7 @@ func TestDetectFramework_CakePHPFalsePositive(t *testing.T) {
t.Fatalf("unexpected error: %v", err)
}
if result != nil && result.Name == "CakePHP" {
t.Errorf("false positive: detected CakePHP (confidence %.2f) on prose about cakes", result.Confidence)
t.Errorf("false positive: detected CakePHP (confidence %.2f) on prose naming cakephp", result.Confidence)
}
}

Expand Down Expand Up @@ -893,7 +911,8 @@ func TestDetectFramework_SvelteFalsePositive(t *testing.T) {
func TestDetectFramework_StrapiFalsePositive(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
w.Write([]byte(`<!DOCTYPE html><html><body><script>fetch("/api/v1/users")</script></body></html>`))
// prose naming the CMS plus a plain /api/ path: neither is the powered-by header
w.Write([]byte(`<!DOCTYPE html><html><body><p>built with Strapi</p><script>fetch("/api/v1/users")</script></body></html>`))
}))
defer server.Close()

Expand All @@ -902,14 +921,16 @@ func TestDetectFramework_StrapiFalsePositive(t *testing.T) {
t.Fatalf("unexpected error: %v", err)
}
if result != nil && result.Name == "Strapi" {
t.Errorf("false positive: detected Strapi (confidence %.2f) on a plain /api/ path", result.Confidence)
t.Errorf("false positive: detected Strapi (confidence %.2f) on prose naming strapi", result.Confidence)
}
}

func TestDetectFramework_Strapi(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// the default poweredBy middleware sets this header on every response
w.Header().Set("X-Powered-By", "Strapi <strapi.io>")
w.WriteHeader(http.StatusOK)
w.Write([]byte(`<!DOCTYPE html><html><body><div>powered by strapi</div></body></html>`))
w.Write([]byte(`<!DOCTYPE html><html><body><div>welcome</div></body></html>`))
}))
defer server.Close()

Expand Down
Loading
Loading