fix(javascript): reconstruct HTML script loads accurately (#1042)

* fix: parse HTML script references with HTML semantics

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

* test(javascript): cover exact HTML script resource identity

---------

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>
Co-authored-by: N0zoM1z0 <1705004398@qq.com>
This commit is contained in:
Rudy Mizrahi Celekli
2026-10-08 01:24:24 -04:00
committed by GitHub
parent 53409ab196
commit 1154f2f03c
11 changed files with 475 additions and 22 deletions
@@ -5,7 +5,10 @@ import {
linkElectronRoleToAsset,
type JavaScriptArtifactGraphContext,
} from "./JavaScriptArtifactGraphContext.js";
import { artifactObservationEvidence } from "./JavaScriptArtifactGraphEvidence.js";
import {
artifactObservationEvidence,
staticInferenceEvidence,
} from "./JavaScriptArtifactGraphEvidence.js";
import { completeApplicationCoverage } from "../../domain/javascript/javascriptApplicationEvidenceSchemas.js";
import { resolveArtifactPathByContext } from "./JavaScriptArtifactPathResolution.js";
@@ -57,7 +60,32 @@ export const addJavaScriptHtmlRoles = (
htmlBaseHref: script.base_href,
});
const resolvedPath = resolution.resolved_path;
if (resolvedPath === null) continue;
if (resolvedPath === null) {
context.accumulator.addNode({
kind: role.kind,
identity: role.identity,
observations: [
{
label: script.script_path,
properties: {
mechanism: "html-script-reference",
script_path: script.script_path,
base_href: script.base_href,
...resolution,
},
evidence: staticInferenceEvidence({
sha256: html.sha256,
path: html.path,
range: script.location,
operation: "resolve-html-script-reference",
coverage: completeApplicationCoverage(),
limitations: resolution.limitations,
}),
},
],
});
continue;
}
const resolved = context.fileNodes.get(resolvedPath);
if (resolved === undefined) continue;
addStaticInferenceEdge(context, {