[PR #872] [MERGED] fix(javascript): read open() endpoints only from XHR method/URL pairs #2308

New issue

Closed

opened 2026-10-16 21:17:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:04 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/872
Author: @kaoru0822-kitauji
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/javascript-xhr-open-endpoints

📝 Commits (1)

1be3705 fix(javascript): read open() endpoints only from XHR method/URL pairs

📊 Changes

2 files changed (+44 additions, -1 deletions)

View changed files

📝 src/domain/javascriptStaticAnalysisHelpers.ts (+28 -1)
📝 src/domain/webBundleAnalyzer.test.ts (+16 -0)

📄 Description

Summary

endpointArgument is shared by analyze_javascript_application static analysis and analyze_web_bundle. It treated every call ending in .open that had a string second argument as XMLHttpRequest.open(method, url), which produced false network endpoints:

const fs = require("fs");
fs.open("/tmp/data.txt", "r", () => {});                // endpoint "r"
window.open("https://help.example.com/", "_blank");     // endpoint "_blank"

Before (rea analyze-javascript-application … --filter-output normalized_result.graph.nodes):

["endpoint","_blank","network"]
["endpoint","r","network"]

After, neither call produces an endpoint. indexedDB.open / caches.open storage nodes are unaffected.

The URL is now read as follows:

Literal method: the method must be a standard HTTP method (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, CONNECT, TRACE) in any case, because XHR normalizes those, or an uppercase extension token such as WebDAV PROPFIND.
Computed method (xhr.open(method, "/api")): the URL literal must look like a request URL, meaning an http(s):// or ws(s):// URL, or a path starting with /, ./, or ../. Endpoints that main reports for genuine XHR calls are kept, while fs flags (r, w+) and window targets (_blank) still produce nothing.

No schema or catalog change.

Verification

src/domain/webBundleAnalyzer.test.ts: a new parity case covers GET, lowercase post, PROPFIND, a computed method, and fs.open / window.open with literal and computed first arguments. It fails on main.
Rebuilt CLI run on the sample above: no r / _blank endpoints.
npm run check:changed (38 files, 749 tests) passes. npm run test:focused on the JavaScript/Electron/web-bundle boundary and acceptance tests (62 files) also passes. It excludes the two V8 Inspector runtime files, which fail identically on unmodified main on this host.

No Hopper/Ghidra/IDA verification is needed.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/872 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/javascript-xhr-open-endpoints` --- ### 📝 Commits (1) - [`1be3705`](https://github.com/morluto/rea/commit/1be370543f7ea39016f86ebdec80a8ceaf7f8a28) fix(javascript): read open() endpoints only from XHR method/URL pairs ### 📊 Changes **2 files changed** (+44 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascriptStaticAnalysisHelpers.ts` (+28 -1) 📝 `src/domain/webBundleAnalyzer.test.ts` (+16 -0) </details> ### 📄 Description ## Summary `endpointArgument` is shared by `analyze_javascript_application` static analysis and `analyze_web_bundle`. It treated every call ending in `.open` that had a string second argument as `XMLHttpRequest.open(method, url)`, which produced false network endpoints: ```js const fs = require("fs"); fs.open("/tmp/data.txt", "r", () => {}); // endpoint "r" window.open("https://help.example.com/", "_blank"); // endpoint "_blank" ``` Before (`rea analyze-javascript-application … --filter-output normalized_result.graph.nodes`): ``` ["endpoint","_blank","network"] ["endpoint","r","network"] ``` After, neither call produces an endpoint. `indexedDB.open` / `caches.open` storage nodes are unaffected. The URL is now read as follows: - **Literal method:** the method must be a standard HTTP method (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`, `CONNECT`, `TRACE`) in any case, because XHR normalizes those, or an uppercase extension token such as WebDAV `PROPFIND`. - **Computed method** (`xhr.open(method, "/api")`): the URL literal must look like a request URL, meaning an `http(s)://` or `ws(s)://` URL, or a path starting with `/`, `./`, or `../`. Endpoints that `main` reports for genuine XHR calls are kept, while fs flags (`r`, `w+`) and window targets (`_blank`) still produce nothing. No schema or catalog change. ## Verification - `src/domain/webBundleAnalyzer.test.ts`: a new parity case covers `GET`, lowercase `post`, `PROPFIND`, a computed method, and `fs.open` / `window.open` with literal and computed first arguments. It fails on `main`. - Rebuilt CLI run on the sample above: no `r` / `_blank` endpoints. - `npm run check:changed` (38 files, 749 tests) passes. `npm run test:focused` on the JavaScript/Electron/web-bundle boundary and acceptance tests (62 files) also passes. It excludes the two V8 Inspector runtime files, which fail identically on unmodified `main` on this host. No Hopper/Ghidra/IDA verification is needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:04 +00:00