[PR #2935] [CLOSED] fix(javascript): report skipped inline HTML scripts #5503

Closed
opened 2026-10-31 01:07:09 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2935
Author: @Ha1baraA11
Created: 10/13/2026
Status: ❌ Closed

Base: main ← Head: pr/rea-2834


📝 Commits (2)

  • ab456ee fix(javascript): report skipped inline HTML scripts
  • c4e6696 fix(javascript): preserve inline script analysis gaps

📊 Changes

7 files changed (+164 additions, -23 deletions)

View changed files

➕ src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts (+37 -0)
📝 src/application/javascript/JavaScriptArtifactAnalysis.ts (+60 -16)
📝 src/application/javascript/JavaScriptArtifactAnalysisTypes.ts (+2 -0)
📝 src/application/javascript/JavaScriptArtifactGraphBuilder.ts (+5 -0)
📝 src/application/javascript/JavaScriptSemanticGraphResources.test.ts (+1 -0)
📝 src/domain/javascript/htmlArtifactReferences.test.ts (+26 -0)
📝 src/domain/javascript/htmlArtifactReferences.ts (+33 -7)

📄 Description

Summary

  • Report non-empty inline HTML script elements that JavaScript application analysis does not analyze, including the HTML path and 1-based source locations.
    Related to #2834

Problem and expected behavior

  • Before this change, analysis collected external <script src> references but silently omitted inline classic and module script bodies. The result had no limitation identifying that omission.
  • Add a per-file limitation that identifies inline scripts and their start locations. Keep the existing static-analysis boundary: do not parse or execute their bodies.

Change and scope

  • Extend HTML reference extraction to locate non-empty inline script elements while preserving existing external script references.
  • Add an analysis limitation for each HTML file containing inline scripts, with each script's start line and column.
  • Add parser and application-analysis regression coverage for classic and module scripts, external scripts, empty bodies, whitespace-only bodies, and template content.

Contract and boundary impact

  • Semantic owner and earliest changed stage: HTML artifact reference extraction, before JavaScript parsing; disclose the skipped inline scripts at the existing JavaScript application analysis stage.
  • Contribution scope fit and linked maintainer decision: focused bug fix within the existing contribution scope; routine fixes within existing boundaries do not need advance maintainer approval, so no separate scope decision is applicable.
  • CLI and MCP/tool-catalog contract: add a limitation string to the existing analysis result; no command, result schema, MCP/tool-catalog, package, or installation changes.
  • Provider, bridge, target-format, or platform compatibility: HTML parsing uses the existing parser; no provider, bridge, or platform behavior changes.
  • Evidence, artifact, provenance, or reconstruction contract: retain the HTML artifact path and report inline-script start locations; do not derive findings from the body or claim it was analyzed.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable; this is inert analysis of local artifact text and does not select, launch, or modify a target.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): none; no generated metadata or package files changed.

Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: src/domain/javascript/htmlArtifactReferences.test.ts checks classic/module inline locations and excludes external, empty, whitespace-only, and template scripts; src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts checks the per-file limitation and 1-based locations.
  • Base reproduction or other evidence: before the patch, a fixture passed to analyzeJavaScriptArtifactFiles returned html_scripts: [] and no inline-script limitation. This reproduced the omission at the production analysis boundary.
  • User-visible CLI/MCP output (if applicable): Inline script elements in www/index.html were not analyzed (source locations: 2:1, 3:1).
  • Remaining proof gaps: the packaged CLI was not run because the baseline checkout had no compiled dist/cli-runtime; browser E2E and manual testing were not run. The new regression test exercises the analysis boundary directly.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • bun run verify:test-discovery — all 1,113 test files discovered once.
  • bun run test:local -- src/domain/javascript/htmlArtifactReferences.test.ts src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts — 2 files and 28 tests passed.
  • npm ci — passed with Node.js 24.18.0 and npm 11.16.0.
  • npm run test:focused -- src/ghidra/GhidraInstallation.test.ts — 51 tests passed.
  • npm run check:fast — typecheck and lint passed.
  • git diff --check and staged diff check — passed.
  • This validation record does not claim manual or browser verification; the real-browser E2E suite was not run.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; analysis adds a limitation for previously undisclosed inline scripts.
  • Real Hopper/Ghidra, browser, or OS coverage: no real target, browser E2E, or OS workflow was run; HTML and analysis unit tests cover the changed behavior.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: inline JavaScript remains inert and is neither parsed nor executed; the change only reports source locations from the local HTML artifact.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2935 **Author:** [@Ha1baraA11](https://github.com/Ha1baraA11) **Created:** 10/13/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `pr/rea-2834` --- ### 📝 Commits (2) - [`ab456ee`](https://github.com/morluto/rea/commit/ab456ee012c94eb3e00a14f34e52f51c63a3ea95) fix(javascript): report skipped inline HTML scripts - [`c4e6696`](https://github.com/morluto/rea/commit/c4e669656e2d7ece22ea9d0fb03c2dba71156f8c) fix(javascript): preserve inline script analysis gaps ### 📊 Changes **7 files changed** (+164 additions, -23 deletions) <details> <summary>View changed files</summary> ➕ `src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts` (+37 -0) 📝 `src/application/javascript/JavaScriptArtifactAnalysis.ts` (+60 -16) 📝 `src/application/javascript/JavaScriptArtifactAnalysisTypes.ts` (+2 -0) 📝 `src/application/javascript/JavaScriptArtifactGraphBuilder.ts` (+5 -0) 📝 `src/application/javascript/JavaScriptSemanticGraphResources.test.ts` (+1 -0) 📝 `src/domain/javascript/htmlArtifactReferences.test.ts` (+26 -0) 📝 `src/domain/javascript/htmlArtifactReferences.ts` (+33 -7) </details> ### 📄 Description ## Summary - Report non-empty inline HTML script elements that JavaScript application analysis does not analyze, including the HTML path and 1-based source locations. Related to #2834 ## Problem and expected behavior - Before this change, analysis collected external `<script src>` references but silently omitted inline classic and module script bodies. The result had no limitation identifying that omission. - Add a per-file limitation that identifies inline scripts and their start locations. Keep the existing static-analysis boundary: do not parse or execute their bodies. ## Change and scope - Extend HTML reference extraction to locate non-empty inline script elements while preserving existing external script references. - Add an analysis limitation for each HTML file containing inline scripts, with each script's start line and column. - Add parser and application-analysis regression coverage for classic and module scripts, external scripts, empty bodies, whitespace-only bodies, and template content. ## Contract and boundary impact - Semantic owner and earliest changed stage: HTML artifact reference extraction, before JavaScript parsing; disclose the skipped inline scripts at the existing JavaScript application analysis stage. - Contribution scope fit and linked maintainer decision: focused bug fix within the [existing contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope); routine fixes within existing boundaries do not need advance maintainer approval, so no separate scope decision is applicable. - CLI and MCP/tool-catalog contract: add a limitation string to the existing analysis result; no command, result schema, MCP/tool-catalog, package, or installation changes. - Provider, bridge, target-format, or platform compatibility: HTML parsing uses the existing parser; no provider, bridge, or platform behavior changes. - Evidence, artifact, provenance, or reconstruction contract: retain the HTML artifact path and report inline-script start locations; do not derive findings from the body or claim it was analyzed. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable; this is inert analysis of local artifact text and does not select, launch, or modify a target. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none; no generated metadata or package files changed. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/domain/javascript/htmlArtifactReferences.test.ts` checks classic/module inline locations and excludes external, empty, whitespace-only, and template scripts; `src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts` checks the per-file limitation and 1-based locations. - Base reproduction or other evidence: before the patch, a fixture passed to `analyzeJavaScriptArtifactFiles` returned `html_scripts: []` and no inline-script limitation. This reproduced the omission at the production analysis boundary. - User-visible CLI/MCP output (if applicable): `Inline script elements in www/index.html were not analyzed (source locations: 2:1, 3:1).` - Remaining proof gaps: the packaged CLI was not run because the baseline checkout had no compiled `dist/cli-runtime`; browser E2E and manual testing were not run. The new regression test exercises the analysis boundary directly. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `bun run verify:test-discovery` — all 1,113 test files discovered once. - `bun run test:local -- src/domain/javascript/htmlArtifactReferences.test.ts src/application/javascript/JavaScriptArtifactAnalysis.inlineScripts.test.ts` — 2 files and 28 tests passed. - `npm ci` — passed with Node.js 24.18.0 and npm 11.16.0. - `npm run test:focused -- src/ghidra/GhidraInstallation.test.ts` — 51 tests passed. - `npm run check:fast` — typecheck and lint passed. - `git diff --check` and staged diff check — passed. - This validation record does not claim manual or browser verification; the real-browser E2E suite was not run. ## Compatibility, safety, and release - Breaking changes or migration steps: none; analysis adds a limitation for previously undisclosed inline scripts. - Real Hopper/Ghidra, browser, or OS coverage: no real target, browser E2E, or OS workflow was run; HTML and analysis unit tests cover the changed behavior. - Package or release metadata impact: none. - Security, privacy, process, or containment review: inline JavaScript remains inert and is neither parsed nor executed; the change only reports source locations from the local HTML artifact. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 01:07:09 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5503
No description provided.