[GH-ISSUE #783] Audit empty-string keys in remaining static-property consumers #340

New issue

Closed

opened 2026-10-15 18:24:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:05 +00:00

Owner

Originally created by @rudycelekli on GitHub (Oct 6, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/783

Follow-up scope

As requested in the non-blocking review of #764, audit remaining semanticStaticPropertyName consumers that still use '' for both a known empty key and an unknown computed key. #764's read/destructuring/property-slot fix remains scoped to its tested paths.

Two cases reproduce on the rebased #764 head b453a6cc68cc072acf93486c477783d42b790c06:

process.env[''] is an exact property read, but javascriptSemanticDataEffects.ts projects key: null and resolution: partial, identical to the genuinely dynamic process.env[key] control. The built public analyzer also emits a config-source node with a null key. The key's identity can be known while its environment value remains unknown.
{ ['']() { return 42; } } creates a method whose native Node name is '' and returns 42. javascriptSemanticProjection.ts instead names it [computed@23]; that generated name reaches the public function-node label. A follow-up should retain the exact empty raw name while supplying a valid nonempty display label.

Audit candidates

Inspect the remaining sentinel checks in module provenance and requirePatternBindings (javascriptSemanticProjection.ts), configuration/response fields (javascriptSemanticDataEffects.ts), and static object/module-table helpers. Classify each caller by the representation it needs before migrating it to nullable semanticStaticPropertyKey.

Known API selectors in timer, resource, process, Promise, route, and Electron helpers require their supported names; recognizing an empty key must not invent a supported operation or broaden an API whitelist. Existing helpers that already distinguish empty literals from unknown expressions may need only controls.

Acceptance

For each qualifying consumer, include an ordinary native producer/public analyzer regression, retain a dynamic-key negative control, preserve exact empty raw identities separately from display labels, and keep schema and unknown/partial semantics intact. Track this as a follow-up to #764, rather than expanding its current read/destructuring correction.

Codex assisted on behalf of @rudycelekli with this scoped audit and native/public-consumer reproduction.

Originally created by @rudycelekli on GitHub (Oct 6, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/783 ## Follow-up scope As requested in [the non-blocking review of #764](https://github.com/morluto/rea/pull/764#issuecomment-6022917555), audit remaining `semanticStaticPropertyName` consumers that still use `''` for both a known empty key and an unknown computed key. #764's read/destructuring/property-slot fix remains scoped to its tested paths. Two cases reproduce on the rebased #764 head `b453a6cc68cc072acf93486c477783d42b790c06`: - `process.env['']` is an exact property read, but `javascriptSemanticDataEffects.ts` projects `key: null` and `resolution: partial`, identical to the genuinely dynamic `process.env[key]` control. The built public analyzer also emits a config-source node with a null key. The key's identity can be known while its environment value remains unknown. - `{ ['']() { return 42; } }` creates a method whose native Node name is `''` and returns 42. `javascriptSemanticProjection.ts` instead names it `[computed@23]`; that generated name reaches the public function-node label. A follow-up should retain the exact empty raw name while supplying a valid nonempty display label. ## Audit candidates Inspect the remaining sentinel checks in module provenance and `requirePatternBindings` (`javascriptSemanticProjection.ts`), configuration/response fields (`javascriptSemanticDataEffects.ts`), and static object/module-table helpers. Classify each caller by the representation it needs before migrating it to nullable `semanticStaticPropertyKey`. Known API selectors in timer, resource, process, Promise, route, and Electron helpers require their supported names; recognizing an empty key must not invent a supported operation or broaden an API whitelist. Existing helpers that already distinguish empty literals from unknown expressions may need only controls. ## Acceptance For each qualifying consumer, include an ordinary native producer/public analyzer regression, retain a dynamic-key negative control, preserve exact empty raw identities separately from display labels, and keep schema and unknown/partial semantics intact. Track this as a follow-up to #764, rather than expanding its current read/destructuring correction. Codex assisted on behalf of @rudycelekli with this scoped audit and native/public-consumer reproduction.

bsakaguchi

2026-10-15 18:24:05 +00:00