Summary

Adds a pure-Go alternative to jsluice using dop251/goja parser, enabling CGO-free cross-platform builds.

Fixes #1367

What changed?

  • Added nocgo build tag for CGO-free builds
  • New jsluice_stub.go with goja-based JS endpoint extraction
  • Updated parser_nojs.go to handle -jsluice flag (was silently ignored before)
  • Works identically to jsluice but without tree-sitter/CGO dependency

Usage

# Cross-compile to macOS ARM64 (no CGO needed)
GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -tags nocgo ./cmd/katana
image

Testing

  • CGO build works
  • nocgo build works
  • Cross-compile darwin/arm64 ✓
  • Cross-compile windows/amd64 ✓
  • All unit tests pass

/claim #1367

Summary by CodeRabbit

  • New Features

    • Added JavaScript endpoint extraction to detect URLs and API endpoints inside JS assets, including a CGO-free extractor and tests.
  • Chores

    • Added optional support for scraping jsluice-style JS responses.
    • Added build variants to better support CGO-free targets.
    • Updated module dependencies for JS parsing support.

Claim

Total prize pool $400
Total paid $0
Status Pending
Submitted February 04, 2026
Last updated February 04, 2026

Contributors

RI

Rishi Mondal

@MAVRICK-1

100%

Sponsors

PR

ProjectDiscovery

@projectdiscovery

$200
HE

Hermes1118

@dalledajay-gmail-com

$200