[GH-ISSUE #1781] [Bug] JavaScript sourceMappingURL line comments truncate URLs at asterisks #598

New issue

Closed

opened 2026-10-15 18:26:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:31 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1781

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

analyze-javascript-application silently truncates a source-map URL in a JavaScript line comment at *. The real map is inventoried, but its reference is associated with an unavailable node using the truncated declaration.

For //# sourceMappingURL=app*part.js.map, the returned graph records declared_url: "app", resolved_path: "app.js", and available: false, while also retaining an inventory observation for the existing app*part.js.map. The maps_to edge points at the unavailable reference rather than the inventoried map. The legacy //@ line form behaves the same way.

Reproduction

Build source revision 914ba833ded5f8604345de4e4f6d306de0a38c4e using the pinned toolchain: npm ci, then npm run build:cached.
Generate a tiny local fixture with this Node script:

import { mkdtempSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
const root = mkdtempSync(join(tmpdir(), 'rea-map-star-'));
writeFileSync(join(root, 'app.js'),
  'export const value = 1;\n//# sourceMappingURL=app*part.js.map\n');
writeFileSync(join(root, 'app*part.js.map'),
  JSON.stringify({version: 3, file: 'app.js', sources: [], names: [], mappings: ''}));
console.log(root);

Run node scripts/rea.mjs analyze-javascript-application /tmp/PRINTED-DIRECTORY --max-heap-mb 512 --json.
Inspect the source-map nodes and maps_to edges in normalized_result.graph.

Expected behavior

Retain the full declared line-comment URL and its digest/source range. Resolve the available sibling source map to app*part.js.map with available: true and link to its inventoried node.

Impact and scope

Incorrect source-map reference evidence and lost linkage for valid URLs containing a literal asterisk. Confirmed for modern and legacy JavaScript line comments through the public CLI, with complete graph coverage and exit code 0. This report is limited to line comments; it does not establish a block-comment behavior change or a source-map position-decoding failure.

REA version

6.4.0 source build, commit 914ba833ded5f8604345de4e4f6d306de0a38c4e.

Runtime and platform

Linux x64; Node.js 24.18.0; npm 11.16.0. Serialized CLI probes on one CPU, with 512 MiB Node/analysis-worker heap settings. No native provider or GUI required.

Target and artifact context

Two source-owned, inert fixture files: one small JavaScript module and one valid empty v3 source map. Literal * filenames are supported on the tested Linux filesystem; native Windows filename behavior was not tested.

Interface

CLI

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Reference observation from the failing public CLI result:

{
  "declared_url": "app",
  "declared_url_sha256": "a172cedcae47474b615c54d510a5d84a8dea3032e958587430b413538be3f333",
  "resolved_path": "app.js",
  "available": false
}

The same result includes the inventoried source-map path app*part.js.map. Controls: ordinary //# sourceMappingURL=app.js.map correctly retains the complete declaration and returns available: true; both //# and //@ with the asterisk incorrectly retain only app.

Typed outcome or recovery expected

Correct complete Evidence with the original declared URL and the available map relationship. The selected file should not acquire an artificial unavailable source-map reference due to URL truncation.

Analysis or suspected cause

Confirmed producer behavior matches the directive extraction branch: it searches for /[\s*]/u without distinguishing line-comment termination from block-comment syntax.

ECMA-426's MatchSourceMapURL algorithm matches a non-whitespace URL sequence; the asterisk is accepted in this unambiguous line-comment fixture. The declaration is at the end of the source.

Additional context

Runtime results and the format rule were independently reviewed. A regression should exercise the public CLI and assert the exact declaration, its source range, available inventoried target, and maps_to edge. Keep existing block-comment boundary behavior and large/two-byte-source capacity regressions intact. Related closed #1380 concerns engine-stack overflow on large directives; this reproduction is tiny and concerns incorrect URL contents.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1781 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior `analyze-javascript-application` silently truncates a source-map URL in a JavaScript line comment at `*`. The real map is inventoried, but its reference is associated with an unavailable node using the truncated declaration. For `//# sourceMappingURL=app*part.js.map`, the returned graph records `declared_url: "app"`, `resolved_path: "app.js"`, and `available: false`, while also retaining an inventory observation for the existing `app*part.js.map`. The `maps_to` edge points at the unavailable reference rather than the inventoried map. The legacy `//@` line form behaves the same way. ### Reproduction 1. Build source revision `914ba833ded5f8604345de4e4f6d306de0a38c4e` using the pinned toolchain: `npm ci`, then `npm run build:cached`. 2. Generate a tiny local fixture with this Node script: ```js import { mkdtempSync, writeFileSync } from 'node:fs'; import { tmpdir } from 'node:os'; import { join } from 'node:path'; const root = mkdtempSync(join(tmpdir(), 'rea-map-star-')); writeFileSync(join(root, 'app.js'), 'export const value = 1;\n//# sourceMappingURL=app*part.js.map\n'); writeFileSync(join(root, 'app*part.js.map'), JSON.stringify({version: 3, file: 'app.js', sources: [], names: [], mappings: ''})); console.log(root); ``` 3. Run `node scripts/rea.mjs analyze-javascript-application /tmp/PRINTED-DIRECTORY --max-heap-mb 512 --json`. 4. Inspect the `source-map` nodes and `maps_to` edges in `normalized_result.graph`. ### Expected behavior Retain the full declared line-comment URL and its digest/source range. Resolve the available sibling source map to `app*part.js.map` with `available: true` and link to its inventoried node. ### Impact and scope Incorrect source-map reference evidence and lost linkage for valid URLs containing a literal asterisk. Confirmed for modern and legacy JavaScript line comments through the public CLI, with complete graph coverage and exit code `0`. This report is limited to line comments; it does not establish a block-comment behavior change or a source-map position-decoding failure. ### REA version 6.4.0 source build, commit `914ba833ded5f8604345de4e4f6d306de0a38c4e`. ### Runtime and platform Linux x64; Node.js 24.18.0; npm 11.16.0. Serialized CLI probes on one CPU, with 512 MiB Node/analysis-worker heap settings. No native provider or GUI required. ### Target and artifact context Two source-owned, inert fixture files: one small JavaScript module and one valid empty v3 source map. Literal `*` filenames are supported on the tested Linux filesystem; native Windows filename behavior was not tested. ### Interface CLI ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Reference observation from the failing public CLI result: ```json { "declared_url": "app", "declared_url_sha256": "a172cedcae47474b615c54d510a5d84a8dea3032e958587430b413538be3f333", "resolved_path": "app.js", "available": false } ``` The same result includes the inventoried source-map path `app*part.js.map`. Controls: ordinary `//# sourceMappingURL=app.js.map` correctly retains the complete declaration and returns `available: true`; both `//#` and `//@` with the asterisk incorrectly retain only `app`. ### Typed outcome or recovery expected Correct complete Evidence with the original declared URL and the available map relationship. The selected file should not acquire an artificial unavailable source-map reference due to URL truncation. ### Analysis or suspected cause Confirmed producer behavior matches [the directive extraction branch](https://github.com/morluto/rea/blob/914ba833ded5f8604345de4e4f6d306de0a38c4e/src/domain/javascript/javascriptStaticAnalysisCalls.ts#L353-L359): it searches for `/[\s*]/u` without distinguishing line-comment termination from block-comment syntax. [ECMA-426's `MatchSourceMapURL` algorithm](https://github.com/tc39/ecma426/blob/c724f0f494b44b21b651fdbd6412d3437eef0e72/spec.emu#L1399-L1415) matches a non-whitespace URL sequence; the asterisk is accepted in this unambiguous line-comment fixture. The declaration is at the end of the source. ### Additional context Runtime results and the format rule were independently reviewed. A regression should exercise the public CLI and assert the exact declaration, its source range, available inventoried target, and `maps_to` edge. Keep existing block-comment boundary behavior and large/two-byte-source capacity regressions intact. Related closed #1380 concerns engine-stack overflow on large directives; this reproduction is tiny and concerns incorrect URL contents.

bsakaguchi

2026-10-15 18:26:31 +00:00