Skip to content

chore: update Boss frontend baseline for 2026-07-14 (v10718 / v6230) #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Viy1204 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: update Boss frontend baseline for 2026-07-14 (v10718 / v6230) #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions docs/anti-detection.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,14 @@
# Boss 反自动化检测：防御策略文档

## 2026-07-14 baseline review

- Captured snapshot: `docs/research/boss-online-js/2026-07-14`.
- Boss index changed from `v10687` to `v10718`; Boss bundle changed from `v6214` to `v6230`; Zhipin sign stayed `v5309`.
- The change is a cosmetic webpack re-bundle of the boss-index scripts (module split + variable renames). `risk-detection.js` string literals are identical (591/591, differing only in its self-referential version URL) and all 10 regexes are unchanged; the risk-pattern category counts match the 2026-07-13 baseline exactly. No new anti-debug / fingerprinting was introduced.
- Same-URL hash changes: 0 (all sign, warlock, patas, mqtt, browser-check scripts unchanged). Only version-bumped boss-index and boss-bundle entry scripts moved.
- `src/common/boss_availability.ts` was updated with the new Boss index and bundle entry scripts plus guarded hashes.
- `src/common/boss_page_guards.ts` request guards use version-independent wildcards and still cover the observed risk/security/report URLs in this snapshot.

## 2026-07-13 baseline review

- Captured snapshot: `docs/research/boss-online-js/2026-07-13`.
Expand Down
3 changes: 3 additions & 0 deletions docs/research/boss-online-js/2026-07-14/.gitattributes
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
raw/** -text diff
manifest.json text eol=lf
analysis.md text eol=lf
119 changes: 119 additions & 0 deletions docs/research/boss-online-js/2026-07-14/analysis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,119 @@
# Boss Frontend Analysis - 2026-07-14

Baseline compared: 2026-07-13

## Versions

- Current Boss index: v10718
- Previous Boss index: v10687
- Current Boss bundle: v6230
- Previous Boss bundle: v6214
- Current Zhipin sign: v5309
- Previous Zhipin sign: v5309

## Asset Diff

- Added URLs: 28
- Removed URLs: 27
- Same-URL hash changes: 0

### Added URLs

- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/100.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/117.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/140.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/212.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/270.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/278.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/366.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/471.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/526.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/692.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/754.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/756.js
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/remoteEntry.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/122.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/140.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/212.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/272.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/278.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/296.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/336.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/692.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/756.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/799.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/893.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/app.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/polyfill.js
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/risk-detection.js

### Removed URLs

- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/100.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/117.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/140.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/212.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/270.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/278.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/366.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/471.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/526.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/692.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/754.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/js/756.js
- https://static.zhipin.com/zhipin-boss/bundle/v6214/static/remoteEntry.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/122.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/140.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/212.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/272.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/278.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/347.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/477.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/564.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/692.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/756.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/893.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/app.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/polyfill.js
- https://static.zhipin.com/zhipin-boss/index/v10687/static/js/risk-detection.js

## High-Risk Pattern Hits

- raw/static/zhipin/geek/sdk/browser-check-v2.js: Function(=1, console=1
- raw/assets/sdk/apm/patas-compat.2.1.0.min.js: MutationObserver=2, sendAction=1, Function(=1, constructor=43, setInterval=1, console=14
- raw/assets/sdk/apm/patas.2.3.0.min.js: sendAction=1, constructor=6, setInterval=1, console=12
- raw/assets/sdk/warlock/warlockdata.min.2.2.14.js: constructor=3, console=8
- raw/assets/sdk/warlock/warlockdata.min.2.2.15.js: constructor=3, console=8
- raw/boss-index-v10718/risk-detection.js: 99001=2, 99002=1, 99004=1, 99005=1, srcdoc=1, MutationObserver=2, isTrusted=5, sendAction=2, Function(=1, constructor=3, setInterval=1, console=5, devtools=1, security=1
- raw/zhipin-sign-v5309/app.ee012dc3.js: sendAction=1, setInterval=1, console=3, verify=6, security=1
- raw/zhipin-sign-v5309/iframe-core.7fa9fa18.js: MutationObserver=5, constructor=8, console=4, devtools=6
- raw/zhipin-sign-v5309/vendors~app.9ac375ae.js: srcdoc=1, MutationObserver=4, Function(=12, constructor=86, setInterval=4, console=46, verify=5, security=3, 403.html=2

## Skipped Nested Script URLs

These URLs were discovered inside downloaded JavaScript but are outside the capture host allowlist.

- https://github.com/dcodeIO/ProtoBuf.js (from https://static.zhipin.com/assets/zhipin/chat/mqtt-v1.2.min.js)
- https://unpkg.weizhipin.com/@datastar/warlock-detect-dom@latest/dist/index.js (from https://static.zhipin.com/assets/sdk/warlock/warlockdata.min.2.2.14.js, https://static.zhipin.com/assets/sdk/warlock/warlockdata.min.2.2.15.js)

## Unresolved Inferred Script URLs

These URLs were inferred from webpack runtime chunk ids but could not be downloaded.

- https://img.bosszhipin.com/v2/upload/boss-zhipin/static/debug-update.js: HTTP 404 Not Found while fetching https://img.bosszhipin.com/v2/upload/boss-zhipin/static/debug-update.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js)
- https://img.bosszhipin.com/v2/upload/boss-zhipin/static/update.js: HTTP 404 Not Found while fetching https://img.bosszhipin.com/v2/upload/boss-zhipin/static/update.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/336.js, https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js)
- https://static.zhipin.com/nebula-web/nebulartc-2.3.9.js: HTTP 404 Not Found while fetching https://static.zhipin.com/nebula-web/nebulartc-2.3.9.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js)
- https://static.zhipin.com/static/js/fullpage.0.0.0.js: HTTP 404 Not Found while fetching https://static.zhipin.com/static/js/fullpage.0.0.0.js (from https://static.zhipin.com/library/js/plugins/gt.js, https://static.zhipin.com/assets/zhipin/geek/verify-sdk/jiyan/gt.0.5.0.js)
- https://static.zhipin.com/static/js/geetest.0.0.0.js: HTTP 404 Not Found while fetching https://static.zhipin.com/static/js/geetest.0.0.0.js (from https://static.zhipin.com/library/js/plugins/gt.js, https://static.zhipin.com/assets/zhipin/geek/verify-sdk/jiyan/gt.0.5.0.js)
- https://static.zhipin.com/static/remoteEntry.js: HTTP 404 Not Found while fetching https://static.zhipin.com/static/remoteEntry.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js)
- https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/357.js: HTTP 404 Not Found while fetching https://static.zhipin.com/zhipin-boss/bundle/v6230/static/js/357.js (from https://static.zhipin.com/zhipin-boss/bundle/v6230/static/remoteEntry.js)
- https://static.zhipin.com/zhipin-boss/index/v10718/static/js/375.js: HTTP 404 Not Found while fetching https://static.zhipin.com/zhipin-boss/index/v10718/static/js/375.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/polyfill.js, https://static.zhipin.com/zhipin-boss/index/v10718/static/js/app.js, https://static.zhipin.com/zhipin-boss/index/v10718/static/js/risk-detection.js)
- https://static.zhipin.com/zhipin-security/web/boss/index.js: HTTP 404 Not Found while fetching https://static.zhipin.com/zhipin-security/web/boss/index.js (from https://static.zhipin.com/zhipin-boss/index/v10718/static/js/347.js)

## Recommendation

- Keep boss-cli disabled until the archived raw scripts are manually reviewed.
- Update `src/common/boss_availability.ts` only after accepting the new script versions and hashes.
- Re-check `src/common/boss_page_guards.ts` request patterns against any new risk, security, or reporting script URLs.
- Update `docs/anti-detection.md` with the new versions and risk findings.
Loading