jsdet — JavaScript Detonation Engine

Sandboxed JavaScript execution for security analysis.

What it does

Executes JavaScript in a QuickJS engine compiled to WebAssembly, running inside wasmtime. Every API call is intercepted, observed, and controllable. Nothing escapes.

How to use it

use std::sync::Arc;
use jsdet_core::{CompiledModule, SandboxConfig, EmptyBridge};

let module = CompiledModule::new().unwrap();
let result = module.execute(
    &["console.log('hello')".into()],
    Arc::new(EmptyBridge),
    &SandboxConfig::default(),
).unwrap();

for obs in &result.observations {
    println!("{obs:?}");
}

Consumers

• Sear (URL detonation): uses jsdet-browser bridges for document/window/fetch
• Soleno (extension analysis): uses jsdet-chrome-ext bridges for chrome.* APIs
• Your tool: implement the Bridge trait to provide any API surface

Architecture

┌─────────────────────────────────────────────┐
│ Your Rust application                       │
│                                             │
│  CompiledModule::execute(scripts, bridge)   │
│       │                                     │
│       ▼                                     │
│  ┌─────────────────────────────────┐        │
│  │ wasmtime instance               │        │
│  │  ┌───────────────────────┐      │        │
│  │  │ QuickJS (WASM)        │      │        │
│  │  │                       │      │        │
│  │  │ JS calls fetch() ─────┼──────┼──► Bridge::call("fetch", args)
│  │  │                  ◄────┼──────┼─── returns fake response
│  │  │                       │      │        │
│  │  │ JS calls eval() ──────┼──────┼──► Observation::DynamicCodeExec
│  │  │                       │      │        │
│  │  └───────────────────────┘      │        │
│  │  Linear memory: isolated        │        │
│  │  Fuel metering: bounded         │        │
│  │  Syscalls: zero                 │        │
│  └─────────────────────────────────┘        │
│                                             │
│  Vec<Observation> ← what the code DID       │
└─────────────────────────────────────────────┘