Scan report

xifangczy / cat-catch

View on GitHub (opens in a new tab)
JavaScript
21992 stars
Scanned 24 Sep 2026, 08:13

Report Rescan

Vulnerability Medium

Could an attacker exploit mistakes in this code?

26 risk score

Real issues worth reviewing before you rely on this code.

High: 0
Medium: 12
Low: 3

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

3 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 9
Medium: 0
Low: 1

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

25 total findings

Likely real: 11
Uncertain: 5
Likely noise: 9

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has a medium vulnerability score of 26.0, which indicates that there are several insecure coding patterns in the code that an attacker could potentially exploit to cause problems like denial-of-service or cross-site scripting attacks. While the overall risk is moderate, the scan also identified some signs of malicious intent with a low malicious-pattern score of 3.0, suggesting that certain parts of the code may have been intentionally crafted to be harmful rather than just accidentally buggy. The most critical issues involve dangerous regular expressions that could crash your application and unsafe file path handling that might let attackers access sensitive files on your server. Additionally, there are concerns about how messages are sent across different origins and how strings are being processed, which could lead to security breaches if not addressed carefully. Overall, while the codebase contains some serious security flaws, it does not appear to be entirely malicious, so you should review and fix the identified issues before using this repository in a production environment.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Semgrep 15

Pattern-based code analysis · Vulnerability
YARA 9

Malware signature rules · Malicious pattern
GuardDog 1

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/init.js line 452

Likely real
Yes, 100% confidence

RegExp() called with a `urlPattern` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
return new RegExp(`^${regexPattern}$`, 'i'); // 忽略大小写
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/templates.js line 8

Likely real
Yes, 100% confidence

RegExp() called with a `arg` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
const match = txt.match(new RegExp(...arg));
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/init.js line 362

Likely real
Yes, 100% confidence

RegExp() called with a `item` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
try { reg = new RegExp(item.regex, item.type) } catch (e) { item.state = false; }
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/init.js line 274

Likely real
Yes, 100% confidence

RegExp() called with a `item` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
try { reg = new RegExp(item.regex, item.type) } catch (e) { item.state = false; }
```

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /js/content-script.js line 234
Likely real: Yes, 81% confidence

No validation of origin is done by the addEventListener API. It may be possible to exploit this flaw to perform Cross Origin attacks such as Cross-Site Scripting(XSS).

window.addEventListener("message", (event) => {
        const action = ["catCatchAddMedia", "catCatchAddKey", "catCatchFFmpeg", "catCatchFFmpegResult", "catCatchCloseScript"];
        if (!event.data || !event.data.action || event.origin !== window.location.origin || !action.includes(event.data.action)) { return; }
        event.stopPropagation();
        event.stopImmediatePropagation();

        if (event.data.action == "catCatchAddMedia") {
            if (!event.data.url) { return; }

            /*
             * firefox 不允许直接下载跨域blob内容
             * fetch获取文本内容并缓存到m3u8Text中，供 m3u8.html调用获取。
             */
            if (event.data.url.startsWith("blob:") && isFirefox) {
                fetch(event.data.url)
                    .then(response => response.text())
                    .then(text => {
                        m3u8Text.set(event.data.url, text);
                        sendAddMedia(event.data);
                    });
                return;
            }
            sendAddMedia(event.data);
        }
        if (event.data.action == "catCatchAddKey") {
            let key = event.data.key;
            if (key instanceof ArrayBuffer || key instanceof Array) {
                key = ArrayToBase64(key);
            }
            if (_key.has(key)) { return; }
            _key.add(key);
            chrome.runtime.sendMessage({
                Message: "send2local",
                action: "addKey",
                data: key,
            });
            chrome.runtime.sendMessage({
                Message: "popupAddKey",
                data: key,
                url: event.data.url,
            });
        }
        if (event.data.action == "catCatchFFmpeg") {
            if (!event.data.use ||
                !event.data.files ||
                !event.data.files instanceof Array ||
                event.data.files.length == 0
            ) { return; }
            event.data.title = event.data.title ?? document.title ?? new Date().getTime().toString();
            event.data.title = event.data.title.replaceAll('"', "").replaceAll("'", "").replaceAll(" ", "");
            let data = {
                Message: event.data.action,
                action: event.data.use,
                files: event.data.files,
                url: event.data.href ?? event.source.location.href,
            };
            data = { ...event.data, ...data };
            chrome.runtime.sendMessage(data);
        }
        if (event.data.action == "catCatchFFmpegResult") {
            if (!event.data.state || !event.data.tabId) { return; }
            chrome.runtime.sendMessage({ Message: "catCatchFFmpegResult", ...event.data });
        }
        if (event.data.action == "catCatchCloseScript") {
            if (!event.data.script || !event.isTrusted) { return; }
            chrome.runtime.sendMessage({ Message: "closeScript", ...event.data });
        }

    }, { capture: true });

Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/m3u8.js line 2332

Likely real
Yes, 56% confidence

The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
```
fileData && iframeFFmpeg.contentWindow.postMessage(fileData, '*');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/m3u8.js line 2327

Likely real
Yes, 56% confidence

The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
```
fileData && iframeFFmpeg.contentWindow.postMessage(fileData, '*');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/m3u8.js line 2321

Likely real
Yes, 56% confidence

The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
```
fileData && iframeFFmpeg.contentWindow.postMessage(fileData, '*');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/downloader.js line 430

Likely real
Yes, 56% confidence

The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
```
iframeFFmpeg.contentWindow.postMessage(baseData, '*');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/downloader.js line 427

Likely real
Yes, 56% confidence

The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
```
iframeFFmpeg.contentWindow.postMessage(baseData, '*');
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/preview.js line 127

Likely real
Uncertain, 40% confidence

RegExp() called with a `e` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
```
this.regexFilters = value ? new RegExp(value) : null;
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/tools/sync-locales.js line 50

Likely real
Uncertain, 37% confidence

Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability, where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first.
```
const localeFile = path.join(localesDir, locale, 'messages.json');
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/lib/hls.min.js line 1

Likely real
Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]
```
....BACK_BUFFER_REACHED="hlsBackBufferReached",e.STEERING_MANIFEST_LOADED="hlsSteeringManifestLoaded",e.ASSET_LIST_LOADING="hlsAssetListLoading",e.ASSET_LIST_LOADED="hlsAssetListLoaded",e.INTERSTITIALS_UPDATED="hlsInterstitialsUpdated",e.INTERSTITIALS_...
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/js/m3u8.js line 890

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
console.log(`Error estimating file size for sample ${i}:`, error);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/tools/sync-locales.js line 14

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
console.error(`Error reading ${filePath}:`, error);
```
Engine
Semgrep · Pattern-based code analysis

Counts towards
Vulnerability

File
/tools/sync-locales.js line 27

Likely real
Uncertain, 33% confidence

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.
```
console.error(`Error writing ${filePath}:`, error);
```