mirror of
https://github.com/morluto/rea.git
synced 2026-10-29 19:05:45 +00:00
23f72141d5
* fix(javascript): keep configuration setting reads out of endpoints
Static endpoint extraction reads the first literal argument of any call
named get as an HTTP request path unless the receiver is a provable keyed
collection. VS Code extension bundles read settings through
`workspace.getConfiguration(section).get(key)`, so every setting key
became a network endpoint: the bundled Git extension's dist/main.js
reported 173 network endpoints, nearly all of them setting names such as
`autofetchPeriod` and `blame.statusBarItem.enabled`.
The lexical receiver classifier now records a `configuration` fact for a
`.get` call whose receiver is a `getConfiguration(...)` call, inline or
through a binding whose only visible write is one unconditional
initializer. Minifiers emit `let` for these bindings, so the proof relies
on the recorded writes rather than the declaration kind, as tRPC client
root resolution already does. Endpoint extraction skips non-URL literals
for that fact in both application and web bundle analysis. Reassigned,
conditional, and shadowed receivers, URL or path literals, and other
clients such as `api.get("users")` keep their endpoints.
The receiver fact union was duplicated in three modules; consumers now
import the classifier's type.
On the Git extension bundle, network endpoints drop from 173 to 7 with
unchanged analysis time (2.1 s).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): require the workspace host for configuration receivers
A bare or differently scoped `getConfiguration(...)` may be an
application's own HTTP client factory, so `.get("users")` on its result
lost its endpoint. Only `workspace.getConfiguration(...)` and
`<x>.workspace.getConfiguration(...)` now produce the configuration fact.
Minifiers keep property names, so the bundled VS Code Git extension still
reports 7 network endpoints instead of 173.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix(javascript): recognize default VS Code namespace imports
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
120 lines
4.3 KiB
TypeScript
120 lines
4.3 KiB
TypeScript
import type * as t from "@babel/types";
|
|
import type { JavaScriptOpenReceiverFact } from "./javascriptSemanticAnalysis.js";
|
|
import type { JavaScriptRpcScan } from "./javascriptRpcEndpoints.js";
|
|
|
|
import type {
|
|
JavaScriptBundlerRegistration,
|
|
JavaScriptRolePath,
|
|
JavaScriptStaticAnalysis,
|
|
JavaScriptStaticEndpoint,
|
|
JavaScriptStaticReference,
|
|
JavaScriptStaticStorage,
|
|
} from "./javascriptStaticAnalysisTypes.js";
|
|
import type {
|
|
ElectronCallPath,
|
|
ElectronBrowserWindowFinding,
|
|
ElectronContextBridgeFinding,
|
|
ElectronIpcFinding,
|
|
ElectronNativeAddonBindingFinding,
|
|
ElectronSenderValidationFinding,
|
|
ElectronUtilityProcessFinding,
|
|
} from "./electronStaticAnalysisTypes.js";
|
|
import { JavaScriptModuleRangeIndex } from "./javascriptStaticAnalysisFindings.js";
|
|
|
|
/** Source offsets for one recovered bundle module factory. */
|
|
export interface JavaScriptModuleRange {
|
|
readonly start: number;
|
|
readonly end: number;
|
|
readonly key: string;
|
|
readonly runtime: string;
|
|
readonly requireName: string | null;
|
|
}
|
|
|
|
/** Static finding retained with its source offset until module attribution. */
|
|
export interface LocatedJavaScriptFinding<Value> {
|
|
readonly offset: number;
|
|
readonly value: Value;
|
|
}
|
|
|
|
/** Mutable collections used during one inert AST traversal. */
|
|
export interface JavaScriptAnalysisAccumulator {
|
|
electronCallPaths?: readonly ElectronCallPath[];
|
|
electronCallPathLimitReached?: boolean;
|
|
readonly references: LocatedJavaScriptFinding<JavaScriptStaticReference>[];
|
|
readonly endpoints: LocatedJavaScriptFinding<JavaScriptStaticEndpoint>[];
|
|
readonly storage: LocatedJavaScriptFinding<JavaScriptStaticStorage>[];
|
|
readonly roles: LocatedJavaScriptFinding<JavaScriptRolePath>[];
|
|
readonly sourceMaps: JavaScriptStaticAnalysis["source_map_urls"][number][];
|
|
readonly registrations: JavaScriptBundlerRegistration[];
|
|
readonly browserWindows: LocatedJavaScriptFinding<ElectronBrowserWindowFinding>[];
|
|
readonly contextBridgeApis: LocatedJavaScriptFinding<ElectronContextBridgeFinding>[];
|
|
readonly ipc: LocatedJavaScriptFinding<ElectronIpcFinding>[];
|
|
readonly senderValidations: LocatedJavaScriptFinding<ElectronSenderValidationFinding>[];
|
|
readonly utilityProcesses: LocatedJavaScriptFinding<ElectronUtilityProcessFinding>[];
|
|
readonly nativeAddonBindings: LocatedJavaScriptFinding<ElectronNativeAddonBindingFinding>[];
|
|
readonly moduleRangeIndex: JavaScriptModuleRangeIndex;
|
|
/** `preload` attributes of audio and video elements, which are not scripts. */
|
|
readonly mediaElementPreloads: WeakSet<t.Node>;
|
|
readonly seen: Set<string>;
|
|
visitedNodes: number;
|
|
unknownFindings: number;
|
|
}
|
|
|
|
/** Shared source and accumulator for helper inspections. */
|
|
export interface JavaScriptFindingContext {
|
|
readonly rpcScan: JavaScriptRpcScan;
|
|
readonly source: string;
|
|
readonly accumulator: JavaScriptAnalysisAccumulator;
|
|
readonly openReceiverFacts?: ReadonlyMap<number, JavaScriptOpenReceiverFact>;
|
|
/** Proven Electron export path segments by root offset. */
|
|
readonly electronBindings?: ReadonlyMap<number, readonly string[]>;
|
|
}
|
|
|
|
/** Candidate import, require, worker, or service-worker reference. */
|
|
export interface JavaScriptReferenceInput {
|
|
readonly node: t.Node;
|
|
readonly kind: JavaScriptStaticReference["kind"];
|
|
readonly specifier: string | undefined;
|
|
}
|
|
|
|
/** Candidate route or network endpoint literal. */
|
|
export interface JavaScriptEndpointInput {
|
|
readonly node: t.Node;
|
|
readonly kind: JavaScriptStaticEndpoint["kind"];
|
|
readonly value: string;
|
|
readonly mechanism: string;
|
|
}
|
|
|
|
/** Values required to append one module-attributable static finding. */
|
|
export interface LocatedJavaScriptFindingInput<
|
|
Value extends { readonly module_key: string | null },
|
|
> {
|
|
readonly collection: LocatedJavaScriptFinding<Value>[];
|
|
readonly key: string;
|
|
readonly node: t.Node;
|
|
readonly value: Value;
|
|
}
|
|
|
|
/** Create isolated mutable state for one source analysis. */
|
|
export const createJavaScriptAnalysisAccumulator = (
|
|
sourceLength: number,
|
|
): JavaScriptAnalysisAccumulator => ({
|
|
references: [],
|
|
endpoints: [],
|
|
storage: [],
|
|
roles: [],
|
|
sourceMaps: [],
|
|
registrations: [],
|
|
browserWindows: [],
|
|
contextBridgeApis: [],
|
|
ipc: [],
|
|
senderValidations: [],
|
|
utilityProcesses: [],
|
|
nativeAddonBindings: [],
|
|
moduleRangeIndex: new JavaScriptModuleRangeIndex(sourceLength),
|
|
mediaElementPreloads: new WeakSet(),
|
|
seen: new Set(),
|
|
visitedNodes: 0,
|
|
unknownFindings: 0,
|
|
});
|