mirror of
https://github.com/morluto/rea.git
synced 2026-10-28 10:25:42 +00:00
Kaoru0822andClaude Opus 5.5
63b43b69bb
* fix(javascript): refuse Webpack loaders that can fall off the end
The bootstrap integrity proof accepted any loader whose explicit returns
all yielded the module's exports. A loader with no returns, or with only
the cache-hit return, passed vacuously even though its miss path returns
undefined, so a bundled `n(45840).BrowserWindow` became an exact Electron
window.
Require that the loader body cannot complete normally before the proof
checks its returns, so the bundled-call identity stays unresolved while
the literal require("electron") reference is preserved.
Fixes #5958
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(javascript): cover finally completion in Webpack loader proofs
Group the loader completion-path cases in their own suite and add
focused finally cases: a completing finally keeps a falling-through
catch unproven, a finally returning another value stays unresolved, and
a finally returning the exports proves the loader.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test(javascript): keep IPC checks for unresolved Webpack loader cases
Share the unresolved-identity assertion so the completion-path cases
also reject directly attributed IPC observations.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
63 lines
2.3 KiB
TypeScript
63 lines
2.3 KiB
TypeScript
import { expect } from "vitest";
|
|
|
|
import { parseEvidence } from "../../../src/domain/evidence.js";
|
|
import { javascriptApplicationAnalysisResultSchema } from "../../../src/domain/javascript/javascriptApplicationAnalysis.js";
|
|
import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
import { writeFixtureFiles } from "../../support/javascriptApplicationFixture.js";
|
|
|
|
const CACHE_HIT = `
|
|
var cached = cache[key];
|
|
if (cached !== undefined) return cached.exports;`;
|
|
|
|
const loaderSource = (cacheHit: string, missReturn: string) => `(function () {
|
|
var modules = {
|
|
45840: function (module) { module.exports = require("electron"); },
|
|
1: function (module, exports, n) { new (n(45840).BrowserWindow)({}); }
|
|
}, cache = {};
|
|
function n(key) {${cacheHit}
|
|
var module = (cache[key] = { exports: {} });
|
|
modules[key](module, module.exports, n);${missReturn}
|
|
}
|
|
n(1);
|
|
})();`;
|
|
|
|
cliTest.for([
|
|
[
|
|
"the canonical loader",
|
|
loaderSource(CACHE_HIT, "\n return module.exports;"),
|
|
1,
|
|
],
|
|
["a loader that returns only cached exports", loaderSource(CACHE_HIT, ""), 0],
|
|
["a loader without returns", loaderSource("", ""), 0],
|
|
] as const)(
|
|
"attributes the BrowserWindow to Electron only through %s",
|
|
async ([, source, windows], { cli }) => {
|
|
const root = await createTestTempDirectory("rea-webpack-loader-returns-");
|
|
await writeFixtureFiles(root, {
|
|
"main.js": source,
|
|
"package.json": JSON.stringify({ name: "fixture", main: "main.js" }),
|
|
});
|
|
const response = await cli.run({
|
|
arguments: ["analyze-javascript-application", root, "--format", "json"],
|
|
environment: { REA_LOG_LEVEL: "silent" },
|
|
});
|
|
expect(response.exitCode).toBe(0);
|
|
const result = javascriptApplicationAnalysisResultSchema.parse(
|
|
parseEvidence(response.json).normalized_result,
|
|
);
|
|
expect(result.summary.browser_windows).toBe(windows);
|
|
// The literal external stays observed even when the loader is unproven.
|
|
expect(
|
|
result.graph.nodes.flatMap(({ observations }) =>
|
|
observations.map(({ properties }) => properties),
|
|
),
|
|
).toContainEqual(
|
|
expect.objectContaining({
|
|
reference_kind: "require",
|
|
specifier: "electron",
|
|
}),
|
|
);
|
|
},
|
|
);
|