mirror of
https://github.com/morluto/rea.git
synced 2026-11-15 11:13:21 +00:00
mohammadasim224andgensokyo-dev
f99d73bf39
General provenance only knew a literal require, so a bundled Electron
external held in one binding and destructured from another
(`const s=n(K);const{BrowserWindow}=s`) lost its windows and IPC. The
Electron binding origin now follows stable lexical aliases, and stops at
a rebindable binding that direct eval may have changed.
Fixes #4490
Supersedes #6993
Squashed from #6993 and rebased onto main. Rebase adaptation: the walk
uses the caller-selectable precision.alias_selections budget (the fixed
SEMANTIC_ALIAS_SELECTION_LIMIT it used was removed by #9706) and records
alias-selections when it stops there; a test pins that an over-budget
chain is not claimed and the limit is reported.
Co-Authored-By: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
71 lines
2.6 KiB
TypeScript
71 lines
2.6 KiB
TypeScript
import { expect } from "vitest";
|
|
|
|
import { parseEvidence } from "../../../src/domain/evidence.js";
|
|
import { javascriptApplicationAnalysisResultSchema } from "../../../src/domain/javascript/javascriptApplicationAnalysis.js";
|
|
import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
import { writeFixtureFiles } from "../../support/javascriptApplicationFixture.js";
|
|
|
|
const CACHE_HIT = `
|
|
var cached = cache[key];
|
|
if (cached !== undefined) return cached.exports;`;
|
|
|
|
const loaderSource = (cacheHit: string, missReturn: string) => `(function () {
|
|
var modules = {
|
|
45840: function (module) { module.exports = require("electron"); },
|
|
1: function (module, exports, n) { new (n(45840).BrowserWindow)({}); }
|
|
}, cache = {};
|
|
function n(key) {${cacheHit}
|
|
var module = (cache[key] = { exports: {} });
|
|
modules[key](module, module.exports, n);${missReturn}
|
|
}
|
|
n(1);
|
|
})();`;
|
|
|
|
cliTest.for([
|
|
[
|
|
"the canonical loader",
|
|
loaderSource(CACHE_HIT, "\n return module.exports;"),
|
|
1,
|
|
],
|
|
["a loader that returns only cached exports", loaderSource(CACHE_HIT, ""), 0],
|
|
["a loader without returns", loaderSource("", ""), 0],
|
|
[
|
|
"a binding destructured from the canonical loader's result",
|
|
loaderSource(CACHE_HIT, "\n return module.exports;").replace(
|
|
"new (n(45840).BrowserWindow)({});",
|
|
"var electron = n(45840); var { BrowserWindow } = electron; new BrowserWindow({});",
|
|
),
|
|
1,
|
|
],
|
|
] as const)(
|
|
"attributes the BrowserWindow to Electron only through %s",
|
|
async ([, source, windows], { cli }) => {
|
|
const root = await createTestTempDirectory("rea-webpack-loader-returns-");
|
|
await writeFixtureFiles(root, {
|
|
"main.js": source,
|
|
"package.json": JSON.stringify({ name: "fixture", main: "main.js" }),
|
|
});
|
|
const response = await cli.run({
|
|
arguments: ["analyze-javascript-application", root, "--format", "json"],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
expect(response.exitCode).toBe(0);
|
|
const result = javascriptApplicationAnalysisResultSchema.parse(
|
|
parseEvidence(response.json).normalized_result,
|
|
);
|
|
expect(result.summary.browser_windows).toBe(windows);
|
|
// The literal external stays observed even when the loader is unproven.
|
|
expect(
|
|
result.graph.nodes.flatMap(({ observations }) =>
|
|
observations.map(({ properties }) => properties),
|
|
),
|
|
).toContainEqual(
|
|
expect.objectContaining({
|
|
reference_kind: "require",
|
|
specifier: "electron",
|
|
}),
|
|
);
|
|
},
|
|
);
|