[PR #835] [MERGED] fix(javascript): preserve computed Electron member uncertainty #2273

New issue

Closed

opened 2026-10-16 21:16:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:16:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/835
Author: @kaoru0822-kitauji
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/electron-computed-member-keys

📝 Commits (1)

1260cac fix(javascript): preserve computed Electron member uncertainty

📊 Changes

3 files changed (+53 additions, -3 deletions)

View changed files

📝 src/domain/electronStaticAnalysisIpc.ts (+5 -2)
📝 src/domain/electronStaticAnalysisNative.ts (+2 -1)
📝 tests/composition/javascript-applications/electronApplicationAnalysis.test.ts (+46 -0)

📄 Description

Summary

preserve uncertainty for computed identifier member keys in Electron native-addon analysis
reject computed identifier method names from the IPC sender-validation allowlist
add an application-level regression covering both behaviors

Behavior and evidence

On main, require("./native/addon.node")[member] treated the identifier name member as the requested native export, and event.senderFrame.url[startsWith](...) treated the identifier name startsWith as an allowlisted validation method.

The new composition regression failed before the production change because it reported one sender-validation observation. The same native path also projected the identifier name instead of retaining the unknown wildcard member.

Both analyzers now use semanticStaticPropertyName(property, computed). Ordinary dot access and literal computed keys remain statically identifiable; computed identifiers remain unknown. The native binding is retained with requested_members: ["*"], while the computed validation call no longer creates a sender-validation candidate.

Fixes #822.

Validation

33 tests across:
- src/domain/electronNativeLoaderPaths.test.ts
- src/domain/javascriptApplicationGraph.test.ts
- src/domain/javascriptStaticAnalysis.no_finding_caps.test.ts
- tests/composition/javascript-applications/electronApplicationAnalysis.test.ts
- tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts
TypeScript 5.9.3 tsc --noEmit
lint with --deny-warnings on changed files
formatting check on changed files
npm run knip
npm run metadata:check
git diff --check

Unverified coverage

This exercises static JavaScript reconstruction only. It does not execute an Electron application or load a real native addon, and it does not add Windows or macOS runtime coverage. The repository's default TypeScript 7 invocation cannot run in this environment because /proc/self/exe is unavailable, so type-checking used TypeScript 5.9.3.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/835 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/electron-computed-member-keys` --- ### 📝 Commits (1) - [`1260cac`](https://github.com/morluto/rea/commit/1260cacc67b8e0c93fb9434452053feca956e7e7) fix(javascript): preserve computed Electron member uncertainty ### 📊 Changes **3 files changed** (+53 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/electronStaticAnalysisIpc.ts` (+5 -2) 📝 `src/domain/electronStaticAnalysisNative.ts` (+2 -1) 📝 `tests/composition/javascript-applications/electronApplicationAnalysis.test.ts` (+46 -0) </details> ### 📄 Description ## Summary - preserve uncertainty for computed identifier member keys in Electron native-addon analysis - reject computed identifier method names from the IPC sender-validation allowlist - add an application-level regression covering both behaviors ## Behavior and evidence On `main`, `require("./native/addon.node")[member]` treated the identifier name `member` as the requested native export, and `event.senderFrame.url[startsWith](...)` treated the identifier name `startsWith` as an allowlisted validation method. The new composition regression failed before the production change because it reported one sender-validation observation. The same native path also projected the identifier name instead of retaining the unknown wildcard member. Both analyzers now use `semanticStaticPropertyName(property, computed)`. Ordinary dot access and literal computed keys remain statically identifiable; computed identifiers remain unknown. The native binding is retained with `requested_members: ["*"]`, while the computed validation call no longer creates a sender-validation candidate. Fixes #822. ## Validation - 33 tests across: - `src/domain/electronNativeLoaderPaths.test.ts` - `src/domain/javascriptApplicationGraph.test.ts` - `src/domain/javascriptStaticAnalysis.no_finding_caps.test.ts` - `tests/composition/javascript-applications/electronApplicationAnalysis.test.ts` - `tests/composition/javascript-applications/javascriptArtifactReconstruction.test.ts` - TypeScript 5.9.3 `tsc --noEmit` - lint with `--deny-warnings` on changed files - formatting check on changed files - `npm run knip` - `npm run metadata:check` - `git diff --check` ## Unverified coverage This exercises static JavaScript reconstruction only. It does not execute an Electron application or load a real native addon, and it does not add Windows or macOS runtime coverage. The repository's default TypeScript 7 invocation cannot run in this environment because `/proc/self/exe` is unavailable, so type-checking used TypeScript 5.9.3. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:16:35 +00:00