jquery35-local-agent

A jQuery CVE-2020-11023 remediation automation tool that runs on Node.js alone in air-gapped networks (for legacy Java/Spring/JSP projects · no npm install required · no internet required · zero external dependencies)

It handles the entire process needed locally when upgrading jQuery to 3.5+ in old legacy web applications (Spring/JSP family + jQuery 1.x): full static analysis → safe automated fixes (TO-BE generation) → jQuery 3.5.1 + Migrate replacement → Runtime Probe for screens → mock Lab server → AI decision pack → gate checks before production deployment → report.

Features

• No-modification-of-originals principle — all changes are created only in the --target TO-BE folder. Verify via the AS-IS/TO-BE split diff of file clicks in report/index.html before applying.
• False-positive-reducing scanner — not simple regex, but token masking (removing comments/strings/regex) + receiver chain back-tracing + balanced-parenthesis argument parser + in-file taint tracking (promoting ajax callback parameters → DOM sinks) + project-wide callsite type inference (AutoInferred).
• Auto-fix only what is safe — only preemptive changes that work on both jQuery 1.x/3.x, such as .bind→.on, .size()→.length, boolean .attr→.prop. XSS candidates like .html(response) are never auto-fixed, only classified.
• Air-gapped/legacy environment support — ES5 Runtime Probe for Edge IE mode (developer tools restricted), EUC-KR file byte preservation (latin1 round-trip), and direct generation of CSV/XLS reports without npm.
• Default jQuery runtime bundle — patch-jquery automatically places jquery-3.5.1.min.js and jquery-migrate-3.6.0.min.js into the TO-BE tree, so the default combination runs without preparing separate files. The uncompressed jquery-migrate-3.6.0.js is included as well for temporary tracing/debugging.
• AI review-pack — a loop that selects only ambiguous code points (function name + a few surrounding lines, with strings/comments/regex masked) and iteratively learns with an external AI like twenty questions. Once the role of a single company-specific common function (e.g., an AJAX wrapper) is identified, that knowledge propagates to all call sites. Learned knowledge never triggers auto-fixing and only affects classification.
• Hermes local inspection pack (hermes-pack) — separate from external AI questions, generates static verification points for each CASE, local Probe/Lab tests, pass/fail criteria, project-profile reflection templates, and per-CASE mock test-bed web pages. A component pack for accumulating repeated inspection knowledge within an air-gapped network.
• Rulepack for public distribution — separates web root candidates, Probe insertion hints, vendor recommendations, and mock default responses into rules/*.json. Tune by swapping only the rulepack per deployment site without modifying JS code.
• Java/Spring static evidence — without launching Spring, reads @RequestMapping-family annotations and XML configuration to generate ajaxToServerMap.csv, serverEndpoints.csv, hermes_server_evidence.json, and attaches controller hints to mock routes.
• Runtime verification scenarios — matches id/class/name/button text in JSP/HTML against JS selectors to generate, in runtime_scenarios.html, the 1st-network code-only/static, 2nd-network Chrome smoke, and Edge IE mode final sample verification behaviors.
• Runtime Parity analysis — separates how far Local Lab/mock results can be trusted and reports the LOCAL_LAB_OK, CHROME_SMOKE_REQUIRED, IE_FINAL_SAMPLE_REQUIRED lanes, generating runtime_parity.html, runtimeParity.csv, ieModeRisk.csv.
• Optional Runtime Lab template — the public ZIP does not include Docker/JDK/Tomcat/WAR; it provides only a runtime-lab/ scaffold for experimenting with a WAR on Codex/a local PC.
• Voyager/AI verdict copy-paste packet — for air-gapped situations where CSV files cannot be transferred, compresses summary/scenarios/selectors/AJAX into voyager_packet.txt, and compresses into ai_verdict_packet.txt (under 1000 characters) the judgment question of "human review sufficient / additional runtime needed / IEDriver review needed."
• Air-gapped distribution artifacts — records dependency-free/no-communication evidence via airgap_manifest.json/txt, and generates a public distribution ZIP with --mode release-zip.
• Local web console — via 실행0_웹대시보드.bat or --mode ui, handles path browsing in the browser, automatic path calculation, the plan/autofix/patch/Hermes/report pipeline, Local Lab, and opening existing report HTML.
• Aggregation/Inspection Dashboard — In index.html, first view the graphs by type (event-shortcut-load, etc.) and the distribution by directory depth, then click a file to compare the surrounding AS-IS/TO-BE code in a modal.
• Built-in Self-Verification — --mode self-test creates a temporary sample project and verifies the entire cycle. v5.6.10 includes source-only automatic setup, S1–S11 web console step names, path/type aggregation, AS-IS/TO-BE line-break-preserving auto-fix, bundled jQuery auto-placement, old core file cleanup, UI element-based runtime scenarios, code-only/Chrome smoke/IE final sample Runtime Parity, and Voyager/AI verdict copy-paste packet generation.

Quick Start

node run-jquery35-v5.js --mode self-test

node run-jquery35-v5.js --mode ui --port 18088

node run-jquery35-v5.js --source "C:\work\legacy-app" --target "C:\work\legacy-app_jquery35_tobe" --report "C:\work\jquery35_report_v5" --mode plan

The browser console opens at http://127.0.0.1:18088/. Here, simply browsing or entering the source automatically calculates the default paths for TO-BE/report/profile/server-source/verify-source, and you can run individual S1~S11 steps or the Pipeline. If you prefer the command-line approach, open the report\index.html dashboard to check the status, and follow the order in README_FIRST.txt (analysis → auto-fix → jQuery replacement → Probe → Lab → verify-clean). Windows users should modify only the top path in the included 실행0_웹대시보드.bat ~ 실행9_배포ZIP생성.bat and run them.

For public distribution or application to another site, copy project-profile.public.sample.json to create project-profile.json, and if necessary, modify only rules/public-defaults.json, rules/vendor-compat.json, and rules/mock-defaults.json.

node run-jquery35-v5.js --report ".\release" --mode release-zip

Documentation

• README_KO.md — Full manual (judgment criteria, mode descriptions, Git/CI flow, FAQ)
• VENDOR_COMPAT_KO.md — Vendor compatibility brief: jQuery 3.x-compatible versions of jqGrid/jQuery UI/select2/autoNumeric, jQuery UI's own CVEs, behavior changes Migrate cannot restore (self-closing tags, etc.)
• RUN_EXAMPLES_KO.txt — Collection of command examples
• README_FIRST.txt — Quick start

All paths in the documentation (such as C:\work\legacy-app) are examples. Replace them with your actual project paths.

Requirements

Node.js 16+ minimum, Node.js 18+ recommended. That's all.

License

MIT