[PR #2842] [MERGED] fix(browser): read expression-free template literals as module specifiers #5430

New issue

Closed

opened 2026-10-31 01:06:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:06:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2842
Author: @shubhamahuja9999
Created: 10/13/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/web-template-literal-module-imports

📝 Commits (5)

339865d fix(browser): read expression-free template literals as module specifiers
36de6cc fix: reconcile captured main and owned findings for PR #2842
fd31e8a Merge branch 'main' of https://github.com/morluto/rea into fix/web-template-literal-module-imports
86c272f Merge branch 'main' of https://github.com/morluto/rea into fix/web-template-literal-module-imports
16b2ed1 Merge branch 'main' into fix/web-template-literal-module-imports

📊 Changes

4 files changed (+82 additions, -18 deletions)

View changed files

📝 src/browser/WebSourceMapFetcher.ts (+14 -10)
📝 src/domain/webBundleAnalyzer.test.ts (+22 -0)
📝 src/domain/webBundleAnalyzerInspection.ts (+11 -8)
📝 tests/boundary/browser/webSourceMapFetcher.test.ts (+35 -0)

📄 Description

Summary

Fixes #2841
Fixes #2599

Captured-bundle chunk edges (analyze_web_bundle) and source-map original module edges only accepted quoted string literals as import() / require() specifiers. Bundlers such as rolldown emit plain constants as expression-free template literals (import(`./chunk.js`)), so statically known dependencies were dropped while completeness.status stayed complete. On OWASP Juice Shop v20.3.0 this hid every lazy-loaded chunk.

Problem and expected behavior

Smallest trigger: import(`./lazy.js`) yields no dynamic_import edge, while import("./lazy.js") does. In an original source returned by a source map, import(`./dep.js`) and require(`./common.cjs`) yield no original_module_edges entry (#2599).

Violated invariant: an expression-free template literal is an exact string. The canonical module-import extractor (collectWebModuleImports) and the shared exact-literal reader (stringValue / readExactJavaScriptLiteral) already treat it that way. These two dependency readers each repeated a narrower t.isStringLiteral check.

Expected: the same edge kind, specifier, resolved URL/source and location as the quoted form. Template literals with substitutions (import(`./${name}.js`)) stay unrecognized.

Change and scope

src/domain/webBundleAnalyzerInspection.ts: the ImportExpression chunk edge reads its specifier through stringValue, which is already imported there for call-argument specifiers.
src/browser/WebSourceMapFetcher.ts (originalDependency): import() and require() specifiers read through stringValue. require is included because it is the same function and the same brittleness, and captured-bundle require calls already use stringValue.
Not included: route path/route properties and WebMCP objectString, which #2805 / #2823 cover. The two PRs touch different hunks.

Contribution scope: ordinary fix within existing static-analysis boundaries; maintainer decision not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: captured-script static inspection (webBundleAnalyzerInspection.ts) and source-map original dependency extraction (WebSourceMapFetcher.ts).
Contribution scope fit and linked maintainer decision: existing read-only static analysis; not applicable.
CLI and MCP/tool-catalog contract: no schema change; chunks.edges and source_maps.items[].original_module_edges can contain additional entries.
Provider, bridge, target-format, or platform compatibility: none.
Evidence, artifact, provenance, or reconstruction contract: unchanged; new edges use existing kinds, locations and resolution.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: none.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added:
- src/domain/webBundleAnalyzer.test.ts, "reads expression-free template dynamic imports as chunk edges": template, quoted and computed controls, including resolved_url.
- tests/boundary/browser/webSourceMapFetcher.test.ts, "reads expression-free template module specifiers as literals": the #2599 restoration check for import() and require(), computed controls, resolved_source, and retained original text and mappings.
Base reproduction: with the test changes applied to 48a683ac8 and the source fix reverted, both new tests fail (2 failed, 96 passed). With the fix, 98/98 pass.

User-visible output, live run on OWASP Juice Shop v20.3.0 (official release, loopback only, Chrome 155, --observation-ms 3000):

	`dynamic_import` edges
upstream `48a683ac8`	0
with this change	8 (`hacking-instructor`, `confetti`, `faucet.module`, `wallet-web3.module`, `web3-sandbox.module`, `coding-challenge-page.component`, `recycle.component`, `about.component`)

The live "with" run used an earlier local revision that also contained route-property handling, which does not affect chunk edges; the import() code was identical.

Remaining proof gaps: source-map edges were verified through the boundary test only, not against a live site's maps; the real-browser CI lane was not run locally.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

Windows 11, Node.js 24.18.0, npm 11.16.0, rebased on main at 6e25cc3c7:

npm run test:focused -- src/domain/webBundleAnalyzer.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts: both new tests failed without the source fix (2 failed, 96 passed, reproduced on 48a683ac8) and pass with it.
npm run test:focused -- the 12 test files referencing web bundle or source-map analysis (browser/CDP boundary, source-map fetcher/status/coordinates/cleanup, browser CLI, browser MCP, tool-schema validity, target-content provenance): 225/225 passed.
npm run check:fast (typecheck and lint): passed, including as the pre-push hook.
npm run verify:module-boundaries and oxfmt --check on changed files: passed.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: Windows; live Chrome 155 run against a loopback Juice Shop for captured-bundle edges.
Package or release metadata impact: none.
Security, privacy, process, or containment review: read-only static parsing of already captured script and source-map text; no new execution, fetch, or network behavior.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2842 **Author:** [@shubhamahuja9999](https://github.com/shubhamahuja9999) **Created:** 10/13/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/web-template-literal-module-imports` --- ### 📝 Commits (5) - [`339865d`](https://github.com/morluto/rea/commit/339865df7c075c7122629422471e7480ddbdad0d) fix(browser): read expression-free template literals as module specifiers - [`36de6cc`](https://github.com/morluto/rea/commit/36de6cc62ce1ecf39b06668dda0c9199bde8f8e2) fix: reconcile captured main and owned findings for PR #2842 - [`fd31e8a`](https://github.com/morluto/rea/commit/fd31e8af3b8330cfd1e881b297a8b6361c21130a) Merge branch 'main' of https://github.com/morluto/rea into fix/web-template-literal-module-imports - [`86c272f`](https://github.com/morluto/rea/commit/86c272ffb5c018986e365056339a0ec6a7d5882e) Merge branch 'main' of https://github.com/morluto/rea into fix/web-template-literal-module-imports - [`16b2ed1`](https://github.com/morluto/rea/commit/16b2ed1a3f1a0b38a3039517a449043ec05e95c0) Merge branch 'main' into fix/web-template-literal-module-imports ### 📊 Changes **4 files changed** (+82 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/WebSourceMapFetcher.ts` (+14 -10) 📝 `src/domain/webBundleAnalyzer.test.ts` (+22 -0) 📝 `src/domain/webBundleAnalyzerInspection.ts` (+11 -8) 📝 `tests/boundary/browser/webSourceMapFetcher.test.ts` (+35 -0) </details> ### 📄 Description ## Summary Fixes #2841 Fixes #2599 Captured-bundle chunk edges (`analyze_web_bundle`) and source-map original module edges only accepted quoted string literals as `import()` / `require()` specifiers. Bundlers such as rolldown emit plain constants as expression-free template literals (``import(`./chunk.js`)``), so statically known dependencies were dropped while `completeness.status` stayed `complete`. On OWASP Juice Shop v20.3.0 this hid every lazy-loaded chunk. ## Problem and expected behavior Smallest trigger: ``import(`./lazy.js`)`` yields no `dynamic_import` edge, while `import("./lazy.js")` does. In an original source returned by a source map, ``import(`./dep.js`)`` and ``require(`./common.cjs`)`` yield no `original_module_edges` entry (#2599). Violated invariant: an expression-free template literal is an exact string. The canonical module-import extractor (`collectWebModuleImports`) and the shared exact-literal reader (`stringValue` / `readExactJavaScriptLiteral`) already treat it that way. These two dependency readers each repeated a narrower `t.isStringLiteral` check. Expected: the same edge kind, specifier, resolved URL/source and location as the quoted form. Template literals with substitutions (``import(`./${name}.js`)``) stay unrecognized. ## Change and scope - `src/domain/webBundleAnalyzerInspection.ts`: the `ImportExpression` chunk edge reads its specifier through `stringValue`, which is already imported there for call-argument specifiers. - `src/browser/WebSourceMapFetcher.ts` (`originalDependency`): `import()` and `require()` specifiers read through `stringValue`. `require` is included because it is the same function and the same brittleness, and captured-bundle `require` calls already use `stringValue`. - Not included: route `path`/`route` properties and WebMCP `objectString`, which #2805 / #2823 cover. The two PRs touch different hunks. Contribution scope: ordinary fix within existing static-analysis boundaries; maintainer decision not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: captured-script static inspection (`webBundleAnalyzerInspection.ts`) and source-map original dependency extraction (`WebSourceMapFetcher.ts`). - Contribution scope fit and linked maintainer decision: existing read-only static analysis; not applicable. - CLI and MCP/tool-catalog contract: no schema change; `chunks.edges` and `source_maps.items[].original_module_edges` can contain additional entries. - Provider, bridge, target-format, or platform compatibility: none. - Evidence, artifact, provenance, or reconstruction contract: unchanged; new edges use existing kinds, locations and resolution. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added: - `src/domain/webBundleAnalyzer.test.ts`, "reads expression-free template dynamic imports as chunk edges": template, quoted and computed controls, including `resolved_url`. - `tests/boundary/browser/webSourceMapFetcher.test.ts`, "reads expression-free template module specifiers as literals": the #2599 restoration check for `import()` and `require()`, computed controls, `resolved_source`, and retained original text and mappings. - Base reproduction: with the test changes applied to `48a683ac8` and the source fix reverted, both new tests fail (2 failed, 96 passed). With the fix, 98/98 pass. - User-visible output, live run on OWASP Juice Shop v20.3.0 (official release, loopback only, Chrome 155, `--observation-ms 3000`): | | `dynamic_import` edges | |---|---| | upstream `48a683ac8` | 0 | | with this change | 8 (`hacking-instructor`, `confetti`, `faucet.module`, `wallet-web3.module`, `web3-sandbox.module`, `coding-challenge-page.component`, `recycle.component`, `about.component`) | The live "with" run used an earlier local revision that also contained route-property handling, which does not affect chunk edges; the `import()` code was identical. - Remaining proof gaps: source-map edges were verified through the boundary test only, not against a live site's maps; the real-browser CI lane was not run locally. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed Windows 11, Node.js 24.18.0, npm 11.16.0, rebased on `main` at `6e25cc3c7`: - `npm run test:focused -- src/domain/webBundleAnalyzer.test.ts tests/boundary/browser/webSourceMapFetcher.test.ts`: both new tests failed without the source fix (2 failed, 96 passed, reproduced on `48a683ac8`) and pass with it. - `npm run test:focused --` the 12 test files referencing web bundle or source-map analysis (browser/CDP boundary, source-map fetcher/status/coordinates/cleanup, browser CLI, browser MCP, tool-schema validity, target-content provenance): 225/225 passed. - `npm run check:fast` (typecheck and lint): passed, including as the pre-push hook. - `npm run verify:module-boundaries` and `oxfmt --check` on changed files: passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: Windows; live Chrome 155 run against a loopback Juice Shop for captured-bundle edges. - Package or release metadata impact: none. - Security, privacy, process, or containment review: read-only static parsing of already captured script and source-map text; no new execution, fetch, or network behavior. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:06:33 +00:00