fix(javascript): preserve runtime path bytes and Electron ownership (#4941)

* fix(javascript): preserve literal percent runtime paths * fix(javascript): ignore resolve prefixes before the final anchor * fix(electron): retain application roots for loadFile declarations * fix(electron): resolve loadFile from enclosing application package * fix(electron): retain outer application root across package scopes * fix(electron): derive application ownership from inventoried packages * fix(electron): retain resolved package entrypoint ownership * fix(electron): preserve competing application ownership * fix(electron): retain invalid and omitted runtime ownership * fix(electron): preserve omitted module ownership and runtime paths * fix(electron): preserve proven roots before confining page paths * fix(electron): retain possible owners behind missing imports * fix(electron): distinguish absent imports and owned page candidates * fix(electron): keep unavailable JSON out of owner gaps * fix(electron): retain exact loader formats and default entry status * fix(electron): retain unavailable entrypoint ownership candidates * test(ghidra): preserve Windows Node probe prerequisites * test(ghidra): assert cancellation during profile shutdown * fix(electron): separate examined imports from frontend ownership * fix(electron): retain unavailable directory entrypoint owners * test(jeb): retain Linux ownership prerequisite in isolation * fix(javascript): retain unchecked loader ownership and literal main paths * fix(javascript): preserve runtime paths and call-site module aliases * fix(javascript): bound module alias traversal and preserve projections * fix(javascript): retain host module and nested artifact path boundaries * fix(javascript): preserve ESM and archive module loader provenance * test(javascript): distinguish unmapped containers from missing exports * fix: retain default module aliases and Electron builtin imports * fix: preserve host file URL and inward ASAR ownership * fix: preserve CommonJS file URL classification in CI fixtures * fix: retain bound module loaders and Windows entrypoint uncertainty * fix: retain ASAR uncertainty and invalidate changed Electron app roots * fix(javascript): retain ownership uncertainty across loader boundaries * fix(javascript): preserve loader sources and bound alias queries * fix(javascript): retain destructured loader sources * fix(javascript): preserve loader uncertainty at resolution boundaries * fix(javascript): preserve callable and package launch ownership * fix(javascript): preserve captured values across member reads * test(process): assert tagged filesystem cancellation failures * fix(javascript): preserve inventory bases and invocation read timing * fix(javascript): preserve ownership across indirect and unread loads * test(javascript): order fixture directory creation on Windows * test(javascript): share ordered filesystem fixture writer * fix(javascript): unify loader provenance and package validation * fix(javascript): preserve captured Node require loader values * fix(javascript): preserve loader invocation authority * fix(javascript): verify generic loader invocation authority * fix(javascript): preserve conditional loader method alternatives * fix(javascript): require proven factories for source association * fix(javascript): honor replaced Electron app path setters * fix(javascript): prove path and assignment source ownership * fix(javascript): retain native delegate eligibility through shared writes * fix(process): settle stale baseline errors after confirmed absence * fix(javascript): preserve assignment and path boundary evidence * fix(javascript): prove source-directory resolve anchors * fix: preserve application path provenance and portable schemas * fix(javascript): retain CommonJS exported setter effects * fix: isolate Linux identity observations and retain native module exports * fix(javascript): preserve published app and helper provenance * fix(javascript): normalize typed stores and native path fixtures
2026-10-27 06:33:32 -04:00 · 2026-10-20 17:25:19 +08:00
parent d532b18123
commit e9fc8fb30c
149 changed files with 16881 additions and 988 deletions
@@ -0,0 +1,98 @@
+import { runInNewContext } from "node:vm";
+import { expect, it } from "vitest";
+import * as t from "@babel/types";
+
+import { capturedGenericInvocations } from "../../../tests/fixtures/javascriptCapturedGenericInvocations.js";
+import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
+import { parseJavaScriptSource } from "./javascriptSourceParser.js";
+import { indexJavaScriptBindingsWithReceiversSteps } from "./javascriptSemanticAnalysis.js";
+import { completeSemanticSteps } from "./javascriptSemanticTraversal.js";
+import { createSemanticReturnedReferences } from "./javascriptSemanticReturnedReferences.js";
+
+it.each(capturedGenericInvocations)(
+  "retains the authored runtime receiver for $name",
+  ({ source, host, expression }) => {
+    expect(
+      runInNewContext(
+        source,
+        {
+          module: { require: () => "host" },
+        },
+        { timeout: 1_000 },
+      ),
+    ).toBe(host ? "host" : "local");
+    const analysis = analyzeJavaScriptStaticSource(source);
+    expect(analysis.parse_error_count).toBe(0);
+    expect(analysis.references).toEqual(
+      host
+        ? [
+            expect.objectContaining({
+              kind: "require",
+              specifier: null,
+              expression,
+            }),
+          ]
+        : [],
+    );
+  },
+);
+
+it.each([
+  "const table={x:()=>({}),y:()=>({}),z:()=>module};const selected=flag?table.x:table.y;const get=()=>module;const invoke=get.call;invoke.call.call(selected,null).require('./unused.cjs');",
+  "const get=()=>({});const invoke=get.call;const other=function*(){return module;};invoke.call.call(other,null).require('./unused.cjs');",
+  "const get=()=>({});const invoke=get.call;const other=async()=>module;invoke.call.call(other,null).require('./unused.cjs');",
+])("preserves unrelated, generator and promise receivers: %s", (source) => {
+  expect(analyzeJavaScriptStaticSource(source).references).toEqual([]);
+});
+
+it("does not reclassify an ordinary Electron construction as an unknown loader", () => {
+  const analysis = analyzeJavaScriptStaticSource(
+    "const {BrowserWindow}=require('electron');new BrowserWindow().loadFile('index.html');",
+  );
+  expect(analysis.parse_error_count).toBe(0);
+  expect(analysis.references).toEqual([
+    expect.objectContaining({ kind: "require", specifier: "electron" }),
+  ]);
+});
+
+it.each(
+  [32, 550].flatMap((depth) => [true, false].map((host) => ({ depth, host }))),
+)(
+  "retains generic receiver sources when invocation contexts converge at depth $depth (host=$host)",
+  ({ depth, host }) => {
+    const source = `const get=()=>({kind:'local'});const invoke=get.call;const other=()=>${host ? "module" : "({kind:'local'})"};invoke.call(${Array(depth).fill("invoke").join(",")},other,null);`;
+    expect(
+      runInNewContext(source, { module: { kind: "host" } }, { timeout: 1_000 })
+        .kind,
+    ).toBe(host ? "host" : "local");
+    const parsed = parseJavaScriptSource(source);
+    if (parsed === null)
+      throw new Error("Expected bounded generic invocation fixture");
+    const index = completeSemanticSteps(
+      indexJavaScriptBindingsWithReceiversSteps(parsed.program),
+    );
+    completeSemanticSteps(index.indexAmbientWritesSteps());
+    completeSemanticSteps(index.indexMemberMutationFactsSteps());
+    const statement = parsed.program.body.at(-1);
+    if (
+      !t.isExpressionStatement(statement) ||
+      !t.isCallExpression(statement.expression)
+    )
+      throw new Error("Expected final generic invocation");
+    const call = statement.expression;
+    const returned = createSemanticReturnedReferences(
+      index.bindings,
+      "direct-call",
+    )(call.callee, call);
+    expect(
+      returned.references.some(({ node }) =>
+        t.isIdentifier(node, { name: "module" }),
+      ),
+    ).toBe(host);
+    expect(returned.precision).toBe(depth > 512 ? "widened" : "exact");
+    expect(index.bindings.valueResourceLimits.has("alias-selections")).toBe(
+      depth > 512,
+    );
+    if (depth > 512) expect(returned.unresolvedInvocation).toBe(true);
+  },
+);