[PR #2233] [CLOSED] fix(javascript): recover bundled exposeInIsolatedWorld contextBridge exposures #5102

New issue

Closed

opened 2026-10-31 01:03:56 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:03:56 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2233
Author: @chqcjq
Created: 10/12/2026
Status: ❌ Closed

Base: main ← Head: fix/electron-bundled-isolated-world

📝 Commits (1)

2edcb47 fix(javascript): recover bundled exposeInIsolatedWorld contextBridge exposures

📊 Changes

2 files changed (+55 additions, -7 deletions)

View changed files

📝 src/domain/javascript/electronWrappedCallPaths.test.ts (+17 -0)
📝 src/domain/javascript/electronWrappedCallPaths.ts (+38 -7)

📄 Description

Fixes #2174.

Problem

Static application analysis omits an isolated-world contextBridge API exposure when a bundled (webpack-style) CommonJS module factory obtains Electron through its loader parameter. The same bundled shape exposes a main-world API successfully, and the direct (non-bundled) form exposes either world correctly. The missing graph node also leaves summary.context_bridge_apis at zero.

Root cause

collectElectronWrappedCallPaths (electronWrappedCallPaths.ts) only matched contextBridge.exposeInMainWorld in its callee-path dispatch. It had no branch for contextBridge.exposeInIsolatedWorld, which takes a numeric world ID as its first argument (before the string API key). Additionally, the AST traversal entry filter required the first argument to be a string literal, which excluded exposeInIsolatedWorld calls whose first argument is a numeric world ID.

Fix

Match contextBridge.exposeInIsolatedWorld alongside contextBridge.exposeInMainWorld in the callee dispatch.
Adjust argument indexing for the isolated form (worldId=args[0], key=args[1], object=args[2]).
Record world: "isolated" and the numeric world_id in the finding.
Extend the traversal entry filter to accept numeric-first-argument calls (worldId + string key).

Verification

Issue reproduction fixture (bundled/direct × isolated/main): all four forms now return exactly one context-bridge-api node with correct world and world_id.
New regression test: bundled exposeInIsolatedWorld(1001, "isolatedApi", {ping:true}) produces an isolated-world finding with world_id: 1001, resolution_basis: "wrapper-substitution", and members: ["ping"].
All 43 wrapped-call-path tests pass; all 1,147 JavaScript domain tests pass.
npm run check, docs:check, and verify:test-discovery (923 files) all pass.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2233 **Author:** [@chqcjq](https://github.com/chqcjq) **Created:** 10/12/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/electron-bundled-isolated-world` --- ### 📝 Commits (1) - [`2edcb47`](https://github.com/morluto/rea/commit/2edcb475a5ac49d569e8954741b1abe9c559fca4) fix(javascript): recover bundled exposeInIsolatedWorld contextBridge exposures ### 📊 Changes **2 files changed** (+55 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/electronWrappedCallPaths.test.ts` (+17 -0) 📝 `src/domain/javascript/electronWrappedCallPaths.ts` (+38 -7) </details> ### 📄 Description Fixes #2174. ## Problem Static application analysis omits an isolated-world contextBridge API exposure when a bundled (webpack-style) CommonJS module factory obtains Electron through its loader parameter. The same bundled shape exposes a main-world API successfully, and the direct (non-bundled) form exposes either world correctly. The missing graph node also leaves `summary.context_bridge_apis` at zero. ## Root cause `collectElectronWrappedCallPaths` (`electronWrappedCallPaths.ts`) only matched `contextBridge.exposeInMainWorld` in its callee-path dispatch. It had no branch for `contextBridge.exposeInIsolatedWorld`, which takes a numeric world ID as its first argument (before the string API key). Additionally, the AST traversal entry filter required the first argument to be a string literal, which excluded `exposeInIsolatedWorld` calls whose first argument is a numeric world ID. ## Fix - Match `contextBridge.exposeInIsolatedWorld` alongside `contextBridge.exposeInMainWorld` in the callee dispatch. - Adjust argument indexing for the isolated form (worldId=args[0], key=args[1], object=args[2]). - Record `world: "isolated"` and the numeric `world_id` in the finding. - Extend the traversal entry filter to accept numeric-first-argument calls (worldId + string key). ## Verification - Issue reproduction fixture (bundled/direct × isolated/main): all four forms now return exactly one `context-bridge-api` node with correct `world` and `world_id`. - New regression test: bundled `exposeInIsolatedWorld(1001, "isolatedApi", {ping:true})` produces an isolated-world finding with `world_id: 1001`, `resolution_basis: "wrapper-substitution"`, and `members: ["ping"]`. - All 43 wrapped-call-path tests pass; all 1,147 JavaScript domain tests pass. - `npm run check`, `docs:check`, and `verify:test-discovery` (923 files) all pass. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:03:56 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:00 +00:00

[PR #5133] [CLOSED] fix(managed): distinguish truncated compressed signature integers #6781

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5102

No description provided.

Rows
Columns