[GH-ISSUE #822] fix(javascript): computed-identifier member keys in electron native/ipc analyzers #354

New issue

Closed

opened 2026-10-15 18:24:13 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:24:13 +00:00

Owner

Originally created by @morluto on GitHub (Oct 7, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/822

Follow-up to the property-key consolidation (#PR1). Two remaining legacy propertyName(…) uses drop the computed flag and fabricate literal member names from variable lookups — the same bug class as #808/#536:

src/domain/electronStaticAnalysisNative.ts (nativeRequire): require("x")[y] records member "y" instead of unknown.
src/domain/electronStaticAnalysisIpc.ts (inspectValidationCall): xstartsWith matches the startsWith/endsWith/includes allowlist from a variable lookup.

Migrating to semanticStaticPropertyName(key, computed) changes observable findings, so it needs composition-level regressions through ElectronBoundaryAnalysis (see tests/composition/javascript-applications/electronApplicationAnalysis.test.ts) before the switch. The safe migrations (Browser/Values member keys, semantic wrappers, bundle delegation) are done in the keys PR.

Originally created by @morluto on GitHub (Oct 7, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/822 Follow-up to the property-key consolidation (#PR1). Two remaining legacy propertyName(…) uses drop the computed flag and fabricate literal member names from variable lookups — the same bug class as #808/#536: - src/domain/electronStaticAnalysisNative.ts (nativeRequire): require("x")[y] records member "y" instead of unknown. - src/domain/electronStaticAnalysisIpc.ts (inspectValidationCall): x[startsWith](…) matches the startsWith/endsWith/includes allowlist from a variable lookup. Migrating to semanticStaticPropertyName(key, computed) changes observable findings, so it needs composition-level regressions through ElectronBoundaryAnalysis (see tests/composition/javascript-applications/electronApplicationAnalysis.test.ts) before the switch. The safe migrations (Browser/Values member keys, semantic wrappers, bundle delegation) are done in the keys PR.

bsakaguchi

2026-10-15 18:24:13 +00:00

closed this issue
added the
area: native

bug
labels

bsakaguchi referenced this issue

2026-10-16 21:12:52 +00:00

[PR #409] [MERGED] feat(process): record provider and verifier run lineage #1958

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#354

No description provided.

Rows
Columns