[PR #895] [MERGED] fix(javascript): keep storage open versions out of XHR endpoints #2325

New issue

Closed

opened 2026-10-16 21:17:19 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:17:19 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/895
Author: @kaoru0822-kitauji
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @kaoru0822-kitauji

Base: main ← Head: fix/javascript-indexeddb-open-version

📝 Commits (3)

898b0f6 fix(javascript): keep storage open versions out of XHR endpoints
9f48a76 fix(javascript): keep literal HTTP methods on storage-named receivers
5b5b76a chore: merge main and resolve PR #895 conflicts

📊 Changes

2 files changed (+33 additions, -3 deletions)

View changed files

📝 src/domain/javascript/javascriptStaticAnalysisHelpers.ts (+8 -3)
📝 src/domain/webBundleAnalyzer.test.ts (+25 -0)

📄 Description

Summary

Follow-up to #877, which merged before its last review comment was addressed.

#877 reads a computed-method .open(method, url) as XMLHttpRequest.open when the second string literal could be a URL. IndexedDB uses the same callee name with a database name and a version:

indexedDB.open(databaseName, "2");          // endpoint "2" on main
window.indexedDB.open(databaseName, "/v3"); // endpoint "/v3" on main

Both static analysis and captured-bundle analysis published the version string as a network endpoint, while already classifying the same call as indexed-db storage.

endpointArgument now skips .open calls that storageKind recognizes (indexedDB.open, caches.open) before applying the XHR reading. They are still reported as storage. All other .open handling from #877 is unchanged.

No schema or catalog change.

Verification

New case in src/domain/webBundleAnalyzer.test.ts runs both analyzers on the snippet above. It expects no endpoints and two indexed-db storage findings, and fails on main.
npm run check:changed (38 files, 760 tests) passes.

No Hopper/Ghidra/IDA verification is needed.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/895 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Base:** `main` ← **Head:** `fix/javascript-indexeddb-open-version` --- ### 📝 Commits (3) - [`898b0f6`](https://github.com/morluto/rea/commit/898b0f62d76ea1cf793140cb255cad16ab85b44d) fix(javascript): keep storage open versions out of XHR endpoints - [`9f48a76`](https://github.com/morluto/rea/commit/9f48a76e1186cc43c6928eff1c82e93280caee1a) fix(javascript): keep literal HTTP methods on storage-named receivers - [`5b5b76a`](https://github.com/morluto/rea/commit/5b5b76a58363fb15617824a317d48f21542d70cf) chore: merge main and resolve PR #895 conflicts ### 📊 Changes **2 files changed** (+33 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/javascriptStaticAnalysisHelpers.ts` (+8 -3) 📝 `src/domain/webBundleAnalyzer.test.ts` (+25 -0) </details> ### 📄 Description ## Summary Follow-up to #877, which merged before its last review comment was addressed. #877 reads a computed-method `.open(method, url)` as `XMLHttpRequest.open` when the second string literal could be a URL. IndexedDB uses the same callee name with a database name and a version: ```js indexedDB.open(databaseName, "2"); // endpoint "2" on main window.indexedDB.open(databaseName, "/v3"); // endpoint "/v3" on main ``` Both static analysis and captured-bundle analysis published the version string as a network endpoint, while already classifying the same call as `indexed-db` storage. `endpointArgument` now skips `.open` calls that `storageKind` recognizes (`indexedDB.open`, `caches.open`) before applying the XHR reading. They are still reported as storage. All other `.open` handling from #877 is unchanged. No schema or catalog change. ## Verification - New case in `src/domain/webBundleAnalyzer.test.ts` runs both analyzers on the snippet above. It expects no endpoints and two `indexed-db` storage findings, and fails on `main`. - `npm run check:changed` (38 files, 760 tests) passes. No Hopper/Ghidra/IDA verification is needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:17:19 +00:00