[PR #871] [MERGED] fix(javascript): read substitution-free templates as exact strings #2306

New issue

Closed

opened 2026-10-16 21:17:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/871
Author: @kaoru0822-kitauji
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/javascript-template-literal-static-strings

📝 Commits (1)

77cf757 fix(javascript): read substitution-free templates as exact strings

📊 Changes

2 files changed (+81 additions, -7 deletions)

View changed files

➕ src/application/JavaScriptApplicationTemplateLiterals.test.ts (+69 -0)
📝 src/domain/javascriptStaticAnalysisHelpers.ts (+12 -7)

📄 Description

Summary

analyze_javascript_application handled two spellings of the same string differently. A template literal with no substitutions, such as `https://x`, is exactly the same string as 'https://x'. The static string readers (stringValue and argumentValue in javascriptStaticAnalysisHelpers.ts) accepted only quoted StringLiterals, so template spellings lost facts:

Source	Before (template spelling)	Quoted spelling
fetch(`https://api.example.com/v1/users`)	no endpoint	`endpoint` node
new WebSocket(`wss://…`), xhr.open(`GET`, `https://…`)	no endpoint	`endpoint` node
sessionStorage.getItem(`session-id`)	storage keyed `call:sessionStorage.getItem` with no name	storage keyed `session-id`
new Worker(`./worker.js`), `navigator.serviceWorker.register(…)`	unresolved expression	resolved worker module
require(`./dep.js`), import(`./dep.js`)	`require:require(`./dep.js`)` unresolved reference	resolved source module

The Electron IPC reader (electronStaticAnalysisValues.ts) and the data-effect reader (javascriptSemanticDataEffectHelpers.ts) already treat substitution-free templates as exact strings. With this change, the shared readers do the same. Templates with substitutions remain dynamic. A cooked value of null stays unknown; it cannot occur for an untagged template.

No schema or catalog change.

Verification

New src/application/JavaScriptApplicationTemplateLiterals.test.ts analyzes each source above once quoted and once as a template. It asserts identical graph identities, ignoring the file digest. All 10 cases fail on main and pass here.
npm run check:changed: 39 files, 758 tests passed.
npm run test:focused on every JavaScript/Electron/reference-source boundary and acceptance test (68 files) passes, except 4 V8 Inspector tests in tests/boundary/browser/javascriptRuntimeObservation.test.ts and javascriptRuntimeTargetLocations.test.ts. Those 4 fail the same way on unmodified main on this host (Node 26.5, macOS) and are unrelated.
npm run docs:check passes.

No Hopper/Ghidra/IDA verification is needed.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/871 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/javascript-template-literal-static-strings` --- ### 📝 Commits (1) - [`77cf757`](https://github.com/morluto/rea/commit/77cf75710369acc6c304ec352ab25aa7274e04b1) fix(javascript): read substitution-free templates as exact strings ### 📊 Changes **2 files changed** (+81 additions, -7 deletions) <details> <summary>View changed files</summary> ➕ `src/application/JavaScriptApplicationTemplateLiterals.test.ts` (+69 -0) 📝 `src/domain/javascriptStaticAnalysisHelpers.ts` (+12 -7) </details> ### 📄 Description ## Summary `analyze_javascript_application` handled two spellings of the same string differently. A template literal with no substitutions, such as `` `https://x` ``, is exactly the same string as `'https://x'`. The static string readers (`stringValue` and `argumentValue` in `javascriptStaticAnalysisHelpers.ts`) accepted only quoted `StringLiteral`s, so template spellings lost facts: | Source | Before (template spelling) | Quoted spelling | | --- | --- | --- | | ``fetch(`https://api.example.com/v1/users`)`` | no endpoint | `endpoint` node | | ``new WebSocket(`wss://…`)``, ``xhr.open(`GET`, `https://…`)`` | no endpoint | `endpoint` node | | ``sessionStorage.getItem(`session-id`)`` | storage keyed `call:sessionStorage.getItem` with no name | storage keyed `session-id` | | ``new Worker(`./worker.js`)``, ``navigator.serviceWorker.register(…)`` | unresolved expression | resolved worker module | | ``require(`./dep.js`)``, ``import(`./dep.js`)`` | `require:require(`./dep.js`)` unresolved reference | resolved source module | The Electron IPC reader (`electronStaticAnalysisValues.ts`) and the data-effect reader (`javascriptSemanticDataEffectHelpers.ts`) already treat substitution-free templates as exact strings. With this change, the shared readers do the same. Templates with substitutions remain dynamic. A `cooked` value of `null` stays unknown; it cannot occur for an untagged template. No schema or catalog change. ## Verification - New `src/application/JavaScriptApplicationTemplateLiterals.test.ts` analyzes each source above once quoted and once as a template. It asserts identical graph identities, ignoring the file digest. All 10 cases fail on `main` and pass here. - `npm run check:changed`: 39 files, 758 tests passed. - `npm run test:focused` on every JavaScript/Electron/reference-source boundary and acceptance test (68 files) passes, except 4 V8 Inspector tests in `tests/boundary/browser/javascriptRuntimeObservation.test.ts` and `javascriptRuntimeTargetLocations.test.ts`. Those 4 fail the same way on unmodified `main` on this host (Node 26.5, macOS) and are unrelated. - `npm run docs:check` passes. No Hopper/Ghidra/IDA verification is needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:03 +00:00