[GH-ISSUE #3042] [Bug] Static analysis omits EventSource and navigator.sendBeacon URLs from network endpoints #1064

New issue

Closed

opened 2026-10-15 18:30:46 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:30:46 +00:00

Owner

Originally created by @xpeng5278-web on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3042

Observed behavior

Static endpoint extraction (analyze_javascript_application, analyze_web_bundle) reports literal fetch, XMLHttpRequest.open, axios.post and new WebSocket(...) URLs as network endpoints, but two other browser request APIs produce no endpoint at all:

new EventSource(url) (server-sent events), the usual transport for streaming UIs such as LLM chat token streams;
navigator.sendBeacon(url, data), which POSTs to url and is typically used for telemetry or analytics collectors.

As a result, an app's streaming endpoint and its beacon targets are silently missing from the reported network surface, while their WebSocket/fetch siblings in the same file are present.

Minimal reproduction (latest main, `20e4f8309`)

new WebSocket("wss://chat.example/ws");
new EventSource("/api/chat/stream");
new window.EventSource("https://chat.example/events", { withCredentials: true });
navigator.sendBeacon("/api/telemetry", payload);
window.navigator.sendBeacon("https://metrics.example/collect");

Actual endpoints: only wss://chat.example/ws (call:WebSocket).

Expected behavior

These are also reported as network endpoints:

/api/chat/stream (call:EventSource)
https://chat.example/events (call:window.EventSource)
/api/telemetry (call:navigator.sendBeacon)
https://metrics.example/collect (call:window.navigator.sendBeacon)

Dynamic URLs stay unreported, as they are for fetch and WebSocket.

Root cause

endpointArgument in src/domain/javascript/javascriptStaticAnalysisHelpers.ts selects a URL argument only for fetch, *.fetch, WebSocket, *.open, HTTP-verb methods and loadURL. Neither the EventSource constructor nor sendBeacon is in that list, although both take the URL as their first argument.

Originally created by @xpeng5278-web on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3042 ### Observed behavior Static endpoint extraction (`analyze_javascript_application`, `analyze_web_bundle`) reports literal `fetch`, `XMLHttpRequest.open`, `axios.post` and `new WebSocket(...)` URLs as `network` endpoints, but two other browser request APIs produce no endpoint at all: - `new EventSource(url)` (server-sent events), the usual transport for streaming UIs such as LLM chat token streams; - `navigator.sendBeacon(url, data)`, which POSTs to `url` and is typically used for telemetry or analytics collectors. As a result, an app's streaming endpoint and its beacon targets are silently missing from the reported network surface, while their `WebSocket`/`fetch` siblings in the same file are present. ### Minimal reproduction (latest main, 20e4f8309) ```js new WebSocket("wss://chat.example/ws"); new EventSource("/api/chat/stream"); new window.EventSource("https://chat.example/events", { withCredentials: true }); navigator.sendBeacon("/api/telemetry", payload); window.navigator.sendBeacon("https://metrics.example/collect"); ``` Actual endpoints: only `wss://chat.example/ws` (`call:WebSocket`). ### Expected behavior These are also reported as `network` endpoints: - `/api/chat/stream` (`call:EventSource`) - `https://chat.example/events` (`call:window.EventSource`) - `/api/telemetry` (`call:navigator.sendBeacon`) - `https://metrics.example/collect` (`call:window.navigator.sendBeacon`) Dynamic URLs stay unreported, as they are for `fetch` and `WebSocket`. ### Root cause `endpointArgument` in `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` selects a URL argument only for `fetch`, `*.fetch`, `WebSocket`, `*.open`, HTTP-verb methods and `loadURL`. Neither the `EventSource` constructor nor `sendBeacon` is in that list, although both take the URL as their first argument.

bsakaguchi

2026-10-15 18:30:46 +00:00