3 Commits

Include renames

Author	SHA1	Message	Date
吴佳浩Albenandmorluto	3b2522bd3b	fix(javascript): reject a tls protocol version Node refuses at the call site (#9557) ... * fix(javascript): reject a tls protocol version Node refuses at the call site `tls.connect` resolves `minVersion`/`maxVersion` before it opens a socket, so a bad literal throws from the call itself and no socket exists. The acquisition filter decided the port only, so it reported a complete built-in resource for a call that throws. Measured on Node 24.22.1: | `minVersion` / `maxVersion` | outcome | | --- | --- | | `"TLSv1"`, `"TLSv1.1"`, `"TLSv1.2"`, `"TLSv1.3"` | socket created | | `null`, `undefined`, absent | socket created | | `"TLSv1.0"`, `"tlsv1"`, `"tlsv1.2"`, `"TLSv1.4"`, `"nope"`, `""` | THREW `ERR_TLS_INVALID_PROTOCOL_VERSION` | | `5`, `true`, `{}`, `[]` | THREW `ERR_TLS_INVALID_PROTOCOL_VERSION` | | `1n` | THREW `TypeError` | The accepted set is exact and case-sensitive, so it is a closed list rather than a pattern. `net` ignores these members, so only `tls` is consulted. The member is read in write order, which is why `{minVersion: "nope", minVersion: "TLSv1.2"}` keeps its acquisition; a spread, a computed key or an accessor leaves the answer undecided rather than decided against. 22 cases, 11 failing before this commit. `src/domain/javascript`: 5040 to 5062 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors; `knip` 0. * fix(javascript): read every tls options slot and check both version members Four review findings, each measured on Node 24.22.1. All four were real gaps in the first version of this check. **An accepted `minVersion` returned before `maxVersion` was read.** `tls.connect({port: 80, minVersion: "TLSv1.2", maxVersion: "nope"})` throws, because both members are resolved before the socket opens. The loop now continues past an accepted version and returns only for a rejected one. **Only argument zero was read.** `tls` also accepts `(port, options)`, `(port, host, options)` and `(path, options)`, and all three throw on a bad version: `tls.connect(443, {minVersion: "nope"})`, `tls.connect(443, "127.0.0.1", {minVersion: "nope"})` and `tls.connect("/tmp/x.sock", {minVersion: "nope"})`. Every object literal in the argument list is now read; a spread argument shifts those positions, so it leaves the answer undecided instead of picking a wrong slot. **A signed number was left unknown.** `minVersion: -1`, `+1` and `-0` all throw, but they arrive as a `UnaryExpression` and matched none of the literal arms. `readExactJavaScriptLiteral` already normalises `-1` and `+1`; `-0` is the one case it excludes, so a sign over a numeric literal is decided explicitly here rather than treated as unknown. 13 cases added; reverting the slot and loop changes fails 4 of them. `src/domain/javascript`: 5062 to 5075 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors; `knip` 0. * fix(javascript): merge the tls arguments and honour a supplied secure context Four review findings, each measured on Node 24.22.1. All four were real: the previous reader checked each object argument independently and ignored the context. **Several object arguments merge in order, so the later one wins.** The reader rejected the first object and stopped: | call | Node 24.22.1 | | --- | --- | | `tls.connect({port: 443, minVersion: "nope"}, {minVersion: "TLSv1.2"})` | SOCKET | | `tls.connect({port: 443, minVersion: "TLSv1.2"}, {minVersion: "nope"})` | THREW | | `tls.connect({port: 443}, {minVersion: "nope"})` | THREW | The members are now resolved across the whole argument list in write order, so a later argument replaces an earlier one the way Node's merge does. **A supplied `secureContext` bypasses version parsing entirely.** Node uses `options.secureContext || tls.createSecureContext(options)`, so `tls.connect({port: 80, secureContext: ctx, minVersion: "nope"})` connects while a `null` context throws. An unreadable context leaves the answer undecided. **An ordinary method member cannot install a version.** The reader skipped any object containing a method, so `{checkServerIdentity() {}, minVersion: "nope"}` kept a socket Node never creates. Only an accessor runs a body and leaves the member open; a plain method is a value Node never reads as a version name. A `minVersion() {}` member is itself such a value, so it rejects. **Signed BigInt and function-shaped versions were left unknown.** `-1n`, `() => {}`, `function () {}` and `class {}` are all truthy non-strings that Node refuses; none matched an existing arm. They are now decided. 12 cases added; reverting the merge and context changes fails 2 of them and reverting the method arm fails 6. `src/domain/javascript`: 5075 to 5087 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors; `knip` 0. * fix(javascript): read only the options slot tls.connect copies, and its accessors Six review findings, each measured on Node 24.22.1. All six were real. **A falsy `secureContext` does not bypass version parsing.** Node tests `options.secureContext` for truth, so `{secureContext: false, minVersion: "nope"}`, and `0` and `""` with it, all throw. The guard only recognised nullish syntax, so it dropped real throws. `staticTruthiness` now decides the context: a known-falsy value keeps checking, a known-truthy one ends the check, and an unreadable one stays undecided. **Node copies at most one options object.** Measured: | call | result | | --- | --- | | `(443, {minVersion: "TLSv1.2"}, {minVersion: "nope"})` | SOCKET — the third argument is ignored | | `(443, {minVersion: "nope"}, {minVersion: "TLSv1.2"})` | THREW | | `(443, "127.0.0.1", {minVersion: "nope"})` | THREW — the host fills slot 1 | | `({port: 443, minVersion: "nope"}, {minVersion: "TLSv1.2"})` | SOCKET — the second object wins | The reader treated every object argument as merged in order, which let an ignored object decide. `tlsOptionsObjects` now models the two overloads: an object in slot 0 is merged with slot 1, and a port or path in slot 0 makes the first object among slots 1 and 2 the only one read. **An exact computed key names the member.** `{["minVersion"]: "nope"}` throws, but the reader marked every computed key unknown before the shared name resolver saw it. Only an unresolvable key is unknown now, and the case that asserted the old behaviour uses a binding key so it still covers the unknown path. **An accessor can write the member first.** `{get side() { this.minVersion = "TLSv1.2"; }, minVersion: "nope"}` connects, because Node's own copy runs the getter before it reads `minVersion`; and a `set minVersion` in an earlier argument absorbs the later write. Both are bodies this reader does not run, so an accessor anywhere in the merged objects now leaves every version member undecided. A plain method still rejects, since Node never reads it as a version name. **An unshadowed `NaN` or `Infinity` is a non-string version.** Both throw, and neither matched an existing arm. They are decided the same way the adjacent port filter decides them, through `isUnmodifiedGlobalReference`, so a shadowed binding stays unknown. 16 cases added; reverting the truthiness, accessor and computed-key changes fails 2 of them. `src/domain/javascript`: 5075 to 5188 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * fix(javascript): use the nullable key owner and settle unary versions Six review findings, each measured on Node 24.22.1. All six were real, and three of them were removing real sockets. **`semanticStaticPropertyName` encodes an unresolved key as `""`, never `undefined`.** The guard tested `undefined`, so it never fired and an unresolved computed key was read as a member literally named empty. `const k = "minVersion"; tls.connect({port: 443, minVersion: "nope", [k]: "TLSv1.2"})` connects on Node 24.22.1 because the later computed member wins, while the analysis filtered on the stale `"nope"` and dropped the socket. `semanticStaticPropertyKey` is the nullable owner and is now used, with `null` treated as unknown. **A getter can replace a plain version method before Node copies it.** The method branch ignored `accessorWritten`, so `{get side() { this.minVersion = "TLSv1.2"; }, minVersion() {}}` still returned `"rejects"` although it connects. The same unknown result now applies to methods when an accessor is present. **A non-literal second argument is a merged options object, not an absent one.** `const o = {minVersion: "TLSv1.2"}; tls.connect({port: 443, minVersion: "nope"}, o)` connects. The slot reader mapped every non-object to `undefined`, so only the stale first object was examined. A non-object in a copied slot now stays unknown. **`-0` is falsy, so a signed-zero context does not bypass parsing.** The local truthiness helper did not fold a unary `-`, so `{secureContext: -0, minVersion: "nope"}` was treated as a possible bypass although it throws. The shared `staticJavaScriptTruthiness` owner already handles signed zero and replaces the local helper, which is deleted. **A unary operator over a settled operand is a settled non-string version.** `!0`, `!1`, `~~0`, `!!0` and `typeof 1` all throw `ERR_TLS_INVALID_PROTOCOL_VERSION`; the previous arm recognised only `+` and `-`, and the exact-literal and shape arms did not reach them. `void <expr>` stays accepted, because it is `undefined`. The slot reader also had to distinguish a host string in slot 1 from an options object, since `tls.connect(443, "127.0.0.1", {minVersion: "nope"})` throws while `tls.connect(443, {minVersion: "nope"})` is the two-slot form. `src/domain/javascript`: 5188 to 5197 passing. Reverting the key owner fails 1 case and reverting the unary arms fails 2. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * test(javascript): distinguish package scope in route fixtures * test(apple): separate identity and refusal fixture groups * fix(javascript): share TLS option facts and preserve merge uncertainty * fix(javascript): separate TLS assignment authority from copy facts --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-11-09 22:09:29 +08:00
吴佳浩Albenandmorluto	7a1d89a801	fix(javascript): reject child-process option literals Node refuses at the call site (#9594) ... * fix(javascript): reject a spawn stdio string Node refuses at the call site `node:child_process` validates a literal `stdio` string before it creates anything, so a bad value throws from the call itself and no child process exists. The analysis reported the raw string as `stdioMode` and kept the spawn. Measured on Node 24.22.1: | `stdio` | outcome | | --- | --- | | `"pipe"`, `"overlapped"`, `"inherit"`, `"ignore"` | child starts | | `"ipc"`, `"PIPE"`, `"pipe "`, `"pipeline"`, `"stream"`, `"stdio"` | THREW `ERR_INVALID_ARG_VALUE` | The accepted set is exact and case-sensitive, so it is a closed list rather than a pattern. `"ipc"` is the interesting one: it is valid as an array element but refused as the scalar shorthand, which is the shape a caller reaches for when they mean the array form. `fork` differs on one value because it appends `"ipc"` to a string and splits it, so `""` becomes the lone element `"ipc"` and is refused: | call | outcome | | --- | --- | | `spawn(..., {stdio: ""})` | child starts | | `fork(..., {stdio: ""})` | THREW `ERR_INVALID_ARG_VALUE` | `exec` is left alone, because it spreads its options and validates none of them. A number, boolean or object `stdio` is also refused by Node, but `stdioMode` already reports those as `"dynamic"`; deciding them here would claim more than the reported mode explains, so only the string case is decided. 18 cases, 9 failing before this commit. `src/domain/javascript`: 5106 to 5124 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * fix(javascript): reject a non-string cwd or argv0 Node refuses at the call site The same call-site validation the `stdio` string gets applies to `cwd` and `argv0`: Node checks them before the child exists, so a non-string literal throws `ERR_INVALID_ARG_TYPE` and the analysis still reported a spawn. Measured on Node 24.22.1, identical on `spawn`, `fork`, `execFile` and `exec`: | `cwd` / `argv0` | outcome | | --- | --- | | `"/tmp"` / `"x"` | child starts | | `null` | child starts | | `5`, `0`, `true`, `{}`, `[]` | THREW `ERR_INVALID_ARG_TYPE` | `env` is deliberately not in the set: Node accepts any `env` value, including `5` and `"x"`, so a non-object `env` is not a call-site failure. Only an exactly readable literal is decided; a binding, a call or a member read stays undecided, because its value is not settled by this expression. The test file is renamed from `spawn_stdio_literal` to `spawn_option_literals` because it now covers all three members. 16 cases added; reverting this check fails 9 of them. `src/domain/javascript`: 5124 to 5140 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * fix(javascript): read the stdio and path options by value, not by AST kind Seven review findings, each measured on Node 24.22.1. All seven were real, and two of them were removing real children. **`execFile` does not forward `stdio`.** Async `execFile` never passes `options.stdio` to its underlying `spawn`, so `execFile(process.execPath, ["-e", ""], {stdio: "bad"})` returns a real child — `stdioMode` already forces it to `"default"`. The new filter rejected it anyway and dropped the spawn plus its linked interactions. `execFile` is now exempt, like `exec`. **A no-substitution template literal is the same string to Node.** `readExactJavaScriptLiteral` already resolves it, but the filter tested `t.isStringLiteral`, so ``{stdio: `ipc`}`` kept a spawn Node refuses while ``{cwd: `/tmp`}`` — a valid path — was rejected because the same branch called `readExactJavaScriptLiteral` and treated any hit as a non-string. Both sides now read the value and test its type: | call | Node 24.22.1 | | --- | --- | | ``spawn(..., {stdio: `ipc`})`` | THREW `ERR_INVALID_ARG_VALUE` | | ``spawn(..., {stdio: `pipe`})`` | child starts | | ``spawn(..., {cwd: `/tmp`})`` | child starts | | ``spawn(..., {argv0: `x`})`` | child starts | **A shape the literal owner does not price still has a settled type.** `{cwd: 1n}`, `{cwd: /x/}`, `{cwd: () => {}}`, `{cwd: class {}}` and `{cwd: new String("x")}` all throw `ERR_INVALID_ARG_TYPE`, and none matched the previous object/array/boolean arms. **The `fork` explanation was wrong.** Node's `stdioStringToArray` rejects `stdio: ""` with an explicit check before anything is appended; it does not split the string and it never builds an IPC-only array. The rejection was right, the reason was not, so the comment now states the real rule. 44 cases; reverting the `execFile` exemption fails 1, reverting the value-based read fails 1, and reverting the extended non-string arms fails 6. `src/domain/javascript`: 5158 to 5168 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * fix(javascript): keep a path-shaped cwd that Node accepts `cwd` is a path, so Node takes a byte array or a file `URL` there, not only a string. The blanket `NewExpression` arm rejected every constructor for both members, which dropped real children. Measured on Node 24.22.1, identical on `spawn`, `fork`, `execFile` and `exec`: | `cwd` | outcome | | --- | --- | | `new Uint8Array([47, 116, 109, 112])` | child starts | | `new Buffer("/tmp")` | child starts | | `new URL("file:///C:/tmp/")` | child starts | | `new String("/tmp")`, `new Number(1)`, `new Foo("/tmp")` | THREW `ERR_INVALID_ARG_TYPE` | `argv0` is different: it is an argument string only, so `new Uint8Array([120])` and `new URL(...)` both throw there. `isPathConstructor` names the constructors that can produce a path, and only `cwd` consults it. `URL` stays undecided rather than accepted, because whether a file URL resolves is a platform property: `new URL("file:///tmp/")` throws `ERR_INVALID_FILE_URL_PATH` on Windows while a drive-qualified path does not. Syntax alone cannot settle that, so the answer is left open instead of guessed. 8 cases added; reverting the arm fails 3 of them. `src/domain/javascript`: 5168 to 5176 passing. `tsc` 0; `build` 0; `npm run format:check` 0; `npm run lint` 0 errors. * test(javascript): distinguish package scope in route fixtures * test(apple): separate identity and refusal fixture groups * fix(javascript): keep unresolved cwd constructors unknown * refactor(javascript): name process option admission by its contract --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>	2026-11-09 21:46:57 +08:00
morlutoandShuaixinHuang	b46f4fcebd	fix(javascript): preserve loader authority for exact suffixes (#9477) ... * fix(javascript): require exact loader suffix case * fix(javascript): share exact loader mode across import resolution * test(process): align symlink fixture with filesystem checkpoints * test(javascript): normalize the module resolution oracle path separators * test(frida): assert the CLI spawn Evidence contract * test(mcp): use an unsupported analysis-view parent * test(browser): separate source-location line bounds from parity * fix(javascript): preserve uncertain loader provenance * test(javascript): cover uncertain require resolution * fix(javascript): retain conditional Electron evidence * fix(javascript): preserve timed semantic provenance * fix(javascript): retain conditional builtin effects * test(javascript): distinguish bundled host authority * fix(javascript): preserve nested loader invocation identity * test(javascript): qualify Electron fixture authority * fix(javascript): preserve loader invocation authority * fix(javascript): respect source order for resolver escapes * fix(javascript): check nested loader callable mutations * fix(javascript): retain conditional constructor requests * fix(reference): retain constructor loader relationships * fix(reference): follow nested loader callable paths * refactor(javascript): share callable mutation interpretation * fix(javascript): require exact package loader suffixes * refactor(javascript): unify conditional relation evidence * refactor(javascript): unify conditional node evidence * fix(javascript): retain unknown authority for mixed case sources * fix(javascript): preserve loader uncertainty for dotfiles * fix(reference): classify javascript suffix dotfiles * test(reference): cover suffix dotfiles through cli * fix(javascript): retain equivalent conditional built-in origins * fix(javascript): preserve wrapped resolver operation * fix(javascript): retain nested conditional built-in receivers * test(javascript): declare CommonJS in native addon fixtures * fix(javascript): retain wrapped resolver candidates * style: format merged native command schema * fix(javascript): preserve uncertain loader authority * test(javascript): require candidate preload evidence * test(javascript): cover reference loader member writes --------- Co-authored-by: ShuaixinHuang <1836656514@qq.com>	2026-11-09 13:21:24 +08:00