Wappalyzer: Unable to detect React app

[mxschmitt]

Unable to detect a React application which is build with https://github.com/facebookincubator/create-react-app.
It should be detect at least:

• React
• Webpack

[jvoisin]

React and webpack are already detected, but do feel free to investigate other ways to improve their respective detection.

[mxschmitt]

In this application e.g. which source code is located here, there won't be anything detected.

[jvoisin]

Well, how would you detect the presence of react and webpack? I don't see anything fingerprintable.

[mxschmitt]

Maybe take a look how https://github.com/facebook/react-devtools. They can detect if React is used.

[mxschmitt]

Here is described how the detection works:

https://github.com/facebook/react-devtools/blob/b370497ba6e873c63479408f11d784095523a630/backend/backend.js#L1-L23

=> React itself calls inject() on the __REACT_DEVTOOLS_GLOBAL_HOOK__ object.

[jvoisin]

Unfortunately, this is not how Wappalyzer is working.

[gadcam]

I looked into the a few days ago : it is a bit complicated to understand exactly how it works and it seems to be active detection and we can only use passive detection currently see https://www.wappalyzer.com/docs/specification.

[TheShrike]

React is no longer detected on netflix too

[kirainmoe]

It seems that wappalyzer can detect React only if your React app contains data-react* attribute or window.React is defined. React version >= 16.0 may not be detected correctly by wappalyzer.

[gadcam]

@TheShrike, @kirainmoe & @mxschmitt since a few weeks we can detect JS objects at any depth : does this help ?

[mxschmitt]

@gadcam How does it work? So I could test or figure it out when I have time. :)

[gadcam]

@mxschmitt I meant using the same think you used in #2147 could worth a try. If it is fruitless I think you can close the issue as I do not see any other way to dive in.

[DanielRuf]

The same with any custom / bundled frameworks like jQuery and Foundation which use for example app.js.

[DanielRuf]

Also does not work with minified files / mangled function names.

[gadcam]

@DanielRuf The main problem is to find something that is identifying the library in the result produced by put any type of process name here which is alterring the information we try to detect. If you have any track we would really be happy to hear about that :)

Otherwise, I think we should close this issue as all the concerns written here can be for any application we would want to detect and that we already investigated ways to improve them. Maybe an expert in packing/minifying could help us in the future..

[DanielRuf]

@gadcam something similar like https://github.com/DanielRuf/website-stack

[gadcam]

Thank you for the Foundation pattern! (I do not know if it is independent but a pull request has been opened by @jvoisin in #2192)
The one for jQuery is already here.

For the bootstrap version we have two patterns looking very similar :

//New patterns
bootstrap.Tooltip.VERSION
$.fn.tooltip.Constructor.VERSION

and

//Current patterns
bootstrap.Alert.VERSION
jQuery.fn.tooltip.Constructor.VERSION

I do not know very well jQuery and Bootstrap but my feeling is that we need to add the one with the dollar but not the other as I think it is redundant with the current pattern.
What do you think @DanielRuf ?

[DanielRuf]

Not yet sure as I am currently working on the project.

[neolectron]

this is still up to date btw, newer version of React cannot be detected correctly, aswell as vueJs.
This is sad, since its the 2 most starred js framework on github. And also part of most starred repo ever.
I think it would be worth-it investigate this specific issue.

[DanielRuf]

aswell as vueJs

How would be the code for something like a window.vue check? Then I'all add it to my project.

[DanielRuf]

(I do not know if it is independent but a pull request has been opened by @jvoisin in #2192)

Not that what I do and not as reliable as mine is ;-) So this is not related to my code or anything else.

[codekiln]

Would love to see this solved. Linking this to #2450 "_Extend JS Detection beyond global variables?_" which is likely a solution.

FEATURE REQUEST: official docs on how JS library authors can make their libraries detected by Wapalyzer _when they are included in a minified bundle_. Library authors think of services like Wapalyzer as google analytics for library adoption and are incentivized to make it more easily detectable to Wapalyzer; some simple guidance is likely all that's needed.

[DanielRuf]

FEATURE REQUEST: official docs on how JS library authors can make their libraries detected by Wapalyzer _when they are included in a minified bundle_. Library authors think of services like Wapalyzer as google analytics for library adoption and are incentivized to make it more easily detectable to Wapalyzer; some simple guidance is likely all that's needed.

webpack and other bundlers will make it not possible as these do not leak them on the global scope.

[codekiln]

@DanielRuf this feature request is about how to let library authors _opt-in_ to being detected, which doesn't seem technically challenging. For example, one way would be if Wappalyzer attached a function to the window object that library authors could call to register that their library on the page, and inside bundles the library initialization code would call window.wapp && window.wapp.add("react").

[kyletaylored]

Closing this to redirect focus to #2450.