Files
reverse-engineering-anything/src
Kaoru0822andClaude Opus 5.5 57f30029b1 fix(javascript): reject Webpack getters replaced through any identity write (#3860)
The canonical `n.n` getter proof scanned for direct `loader.n =` assignments
and four Object methods on its own. `Reflect.set`, `Reflect.defineProperty`,
`delete`, destructuring and unknown-key writes left the proof intact, so a
replaced or deleted getter still attributed BrowserWindow calls to Electron.
Any Object method call on the loader also rejected the proof, even for an
unrelated key.

The proof now uses the shared identity-write owner
(`collectJavaScriptIdentityWritesSteps` with the module interop's intrinsic
resolution), as ambient writes already do. A write whose path may select `n`
(the key itself, an unknown key, or the whole loader) counts; exactly one
canonical assignment installed before entry dispatch remains required.

Fixes #3315

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-14 23:25:18 -07:00
..