[GH-ISSUE #3451] [Bug] Static endpoint discovery omits template-literal, variable-base and URL-object request targets #1291

New issue

Closed

opened 2026-10-16 21:03:50 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:03:50 +00:00

Owner

Originally created by @gkobayashi0 on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3451

Before submitting

I searched the open and closed issues for a related report. (Closest: #3042 for EventSource/sendBeacon, #2805 for template-literal routes in analyze_web_bundle.)
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application reports a network endpoint only when the request target is a plain string literal passed directly to fetch or new WebSocket. Request targets built in other common ways produce no endpoint observation at all.

In a real third-party Electron app, this omitted every first-party backend (its realtime WebSocket host, its API host and its upload host). The same file's literal third-party targets were reported. A text search over the bundle found the omitted hosts immediately.

Reproduction

Ran once on source revision ca7450b (local build), reproduced every time on the original app.

index.js:

const base = process.env.API_URL || "https://api.example.com";
async function a(id, token) {
  await fetch("https://literal.example.com/v1/ping");
  await fetch(`https://core.example.com/notes/${id}/audio/`, { method: "POST" });
  await fetch(`${base}/internal/imports/`, { method: "POST" });
  const u = new URL("wss://realtime.example.com");
  u.searchParams.set("token", token);
  new WebSocket(u.toString());
  new WebSocket(u);
  new WebSocket("wss://literal-ws.example.com");
  const cfg = { wsUrl: "wss://config.example.com" };
  new WebSocket(cfg.wsUrl);
}
module.exports = { a };

package.json: {"name":"repro","main":"index.js"}

rea analyze-javascript-application /path/to/repro --format json --full-output

Actual endpoint nodes:

https://literal.example.com/v1/ping (call:fetch)
wss://literal-ws.example.com (call:WebSocket)

Expected behavior

Each request site is reported as a network endpoint, with the unresolved part kept explicit rather than dropped. For example:

https://core.example.com/notes/${…}/audio/ as a partially resolved template (call:fetch)
${base}/internal/imports/, ideally with the constant fallback https://api.example.com as a candidate base
wss://realtime.example.com through the new URL(...) receiver (call:WebSocket)
wss://config.example.com through a constant object property

If resolution is intentionally out of scope, an unknown/partial endpoint observation at the call site would still prevent the result from reading as "no first-party backend".

Impact and scope

The endpoint list is the main answer to "where does this app send data". Omitting non-literal targets makes the most important hosts disappear in minified production bundles, where template literals and config objects are the norm. The output's general limitation text says missing findings do not prove absence, but no call-site observation points the reader to the unresolved request sites. Untested: analyze_web_bundle, XMLHttpRequest.open, axios.

REA version

Source ca7450b (local build of main; package.json says 6.4.0). The npm release rea-agents@6.4.0 returned the same endpoint set on the original app.

Runtime and platform

Node 24.21.0; macOS 26 (Darwin 25.6.0) arm64

Originally created by @gkobayashi0 on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3451 ### Before submitting - [x] I searched the open and closed issues for a related report. (Closest: #3042 for EventSource/sendBeacon, #2805 for template-literal routes in analyze_web_bundle.) - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze-javascript-application` reports a `network` endpoint only when the request target is a plain string literal passed directly to `fetch` or `new WebSocket`. Request targets built in other common ways produce no endpoint observation at all. In a real third-party Electron app, this omitted every first-party backend (its realtime WebSocket host, its API host and its upload host). The same file's literal third-party targets were reported. A text search over the bundle found the omitted hosts immediately. ### Reproduction Ran once on source revision `ca7450b` (local build), reproduced every time on the original app. `index.js`: ```js const base = process.env.API_URL || "https://api.example.com"; async function a(id, token) { await fetch("https://literal.example.com/v1/ping"); await fetch(`https://core.example.com/notes/${id}/audio/`, { method: "POST" }); await fetch(`${base}/internal/imports/`, { method: "POST" }); const u = new URL("wss://realtime.example.com"); u.searchParams.set("token", token); new WebSocket(u.toString()); new WebSocket(u); new WebSocket("wss://literal-ws.example.com"); const cfg = { wsUrl: "wss://config.example.com" }; new WebSocket(cfg.wsUrl); } module.exports = { a }; ``` `package.json`: `{"name":"repro","main":"index.js"}` ```bash rea analyze-javascript-application /path/to/repro --format json --full-output ``` Actual `endpoint` nodes: - `https://literal.example.com/v1/ping` (`call:fetch`) - `wss://literal-ws.example.com` (`call:WebSocket`) ### Expected behavior Each request site is reported as a `network` endpoint, with the unresolved part kept explicit rather than dropped. For example: - `https://core.example.com/notes/${…}/audio/` as a partially resolved template (`call:fetch`) - `${base}/internal/imports/`, ideally with the constant fallback `https://api.example.com` as a candidate base - `wss://realtime.example.com` through the `new URL(...)` receiver (`call:WebSocket`) - `wss://config.example.com` through a constant object property If resolution is intentionally out of scope, an `unknown`/partial endpoint observation at the call site would still prevent the result from reading as "no first-party backend". ### Impact and scope The endpoint list is the main answer to "where does this app send data". Omitting non-literal targets makes the most important hosts disappear in minified production bundles, where template literals and config objects are the norm. The output's general limitation text says missing findings do not prove absence, but no call-site observation points the reader to the unresolved request sites. Untested: `analyze_web_bundle`, `XMLHttpRequest.open`, axios. ### REA version Source `ca7450b` (local build of main; package.json says 6.4.0). The npm release `rea-agents@6.4.0` returned the same endpoint set on the original app. ### Runtime and platform Node 24.21.0; macOS 26 (Darwin 25.6.0) arm64

bsakaguchi closed this issue

2026-10-16 21:03:50 +00:00

bsakaguchi commented

2026-10-16 21:03:51 +00:00

Author

Owner

@morluto commented on GitHub (Oct 16, 2026):

Fixed on main in 018ab2c5d. Application endpoint discovery resolves supported stable lexical/URL targets and retains unresolved recognized requests as partial endpoint facts rather than dropping them.

Analyzer, worker, graph and public CLI regressions preserve partial identity and provenance. This closes the application-analysis inventory defect, not a claim of complete runtime endpoint discovery.

Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

@morluto commented on GitHub (Oct 16, 2026): Fixed on `main` in [018ab2c5d](https://github.com/morluto/rea/commit/018ab2c5d9bfbfdf12b5480f3f810f520ca0156b). Application endpoint discovery resolves supported stable lexical/URL targets and retains unresolved recognized requests as partial endpoint facts rather than dropping them. Analyzer, worker, graph and public CLI regressions preserve partial identity and provenance. This closes the application-analysis inventory defect, not a claim of complete runtime endpoint discovery. Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

bsakaguchi referenced this issue

2026-10-17 21:10:03 +00:00

[PR #1291] [MERGED] fix(process): normalize ports that end a sentence #2771

bsakaguchi referenced this issue

2026-10-17 21:10:04 +00:00

[PR #1294] [MERGED] test(process): check malformed capture choices concurrently #2774