diff --git a/src/application/JavaScriptArtifactPathResolution.test.ts b/src/application/JavaScriptArtifactPathResolution.test.ts index d65b325de..d8f94caf2 100644 --- a/src/application/JavaScriptArtifactPathResolution.test.ts +++ b/src/application/JavaScriptArtifactPathResolution.test.ts @@ -474,7 +474,7 @@ describe("contextual JavaScript module identity", () => { const analysis = analyzeJavaScriptStaticSource( ` new BrowserWindow({ webPreferences: { - preload: path.resolve(__dirname, "preload.cjs") + preload: path.resolve("ignored", __dirname, "preload.cjs") }}); new BrowserWindow({ webPreferences: { preload: fileURLToPath(new URL("./preload.mjs", import.meta.url)) @@ -482,6 +482,15 @@ describe("contextual JavaScript module identity", () => { new BrowserWindow({ webPreferences: { preload: path.join(path.dirname(__filename), "legacy-preload.js") }}); + new BrowserWindow({ webPreferences: { + preload: path.posix.resolve("/ignored", dirname(fileURLToPath(import.meta.url)), "esm-preload.js") + }}); + new BrowserWindow({ webPreferences: { + preload: path.posix.resolve(__dirname, "/shared", "absolute-preload.js/") + }}); + new BrowserWindow({ webPreferences: { + preload: path.posix.resolve(\`/templates\`, "template-preload.js") + }}); new BrowserWindow({ webPreferences: { preload: new URL("./remote-base.js", location.href) }}); @@ -503,6 +512,18 @@ describe("contextual JavaScript module identity", () => { path: "legacy-preload.js", resolution_context: "filesystem-expression", }), + expect.objectContaining({ + path: "esm-preload.js", + resolution_context: "filesystem-expression", + }), + expect.objectContaining({ + path: "/shared/absolute-preload.js", + resolution_context: "filesystem-expression", + }), + expect.objectContaining({ + path: "/templates/template-preload.js", + resolution_context: "filesystem-expression", + }), expect.objectContaining({ path: "file:///renderer/index.html", resolution_context: "module-specifier", @@ -519,6 +540,18 @@ describe("contextual JavaScript module identity", () => { preload_path: "./preload.mjs", preload_resolution_context: "filesystem-expression", }), + expect.objectContaining({ + preload_path: "esm-preload.js", + preload_resolution_context: "filesystem-expression", + }), + expect.objectContaining({ + preload_path: "/shared/absolute-preload.js", + preload_resolution_context: "filesystem-expression", + }), + expect.objectContaining({ + preload_path: "/templates/template-preload.js", + preload_resolution_context: "filesystem-expression", + }), ]), ); expect(analysis.role_paths).not.toEqual( diff --git a/src/domain/javascriptStaticAnalysisHelpers.ts b/src/domain/javascriptStaticAnalysisHelpers.ts index 74e32c5cc..1f1c3a959 100644 --- a/src/domain/javascriptStaticAnalysisHelpers.ts +++ b/src/domain/javascriptStaticAnalysisHelpers.ts @@ -192,8 +192,11 @@ const staticCallPath = ( isFileIdentity(argumentNode(node.arguments[0])) ) return ""; - if (!name.endsWith(".join") && !name.endsWith(".resolve") && name !== "join") - return undefined; + if (name.endsWith(".resolve")) + return name === "win32.resolve" || name.endsWith(".win32.resolve") + ? undefined + : staticResolvedPath(node); + if (!name.endsWith(".join") && name !== "join") return undefined; const parts: string[] = []; for (const argument of node.arguments) { if (isDirectoryIdentity(argumentNode(argument))) continue; @@ -204,6 +207,32 @@ const staticCallPath = ( return parts.length === 0 ? undefined : posix.join(...parts); }; +const staticResolvedPath = ( + node: t.CallExpression | t.NewExpression, +): string | undefined => { + const parts: (string | null)[] = []; + for (const argument of node.arguments) { + if (isDirectoryIdentity(argumentNode(argument))) { + parts.push(null); + continue; + } + const value = t.isNode(argument) ? staticPathAt(argument) : undefined; + // Validate every argument, including those before the last anchor. + if (value === undefined) return undefined; + parts.push(value); + } + const anchor = parts.findLastIndex( + (part) => part === null || posix.isAbsolute(part), + ); + // Relative-only calls depend on the target process cwd, which is unknown. + if (anchor === -1) return undefined; + // A null anchor is the source directory; preserve its relative projection. + const path = posix.join( + ...parts.slice(anchor).filter((part) => part !== null), + ); + return path === "/" ? path : path.replace(/\/$/u, ""); +}; + const isFilesystemPathExpression = (node: t.Node): boolean => { if (t.isStringLiteral(node)) return node.value.startsWith("/"); if (isFileIdentity(node) || isDirectoryIdentity(node)) return true; @@ -214,6 +243,8 @@ const isFilesystemPathExpression = (node: t.Node): boolean => { ); if (t.isCallExpression(node) || t.isNewExpression(node)) { const name = calleeName(node.callee); + if (name.endsWith(".resolve") && staticCallPath(node) !== undefined) + return true; if (name === "URL" || name.endsWith(".URL")) return isFileIdentity(argumentNode(node.arguments[1])); if (name === "fileURLToPath" || name.endsWith(".fileURLToPath")) diff --git a/src/domain/javascriptStaticPathResolution.test.ts b/src/domain/javascriptStaticPathResolution.test.ts new file mode 100644 index 000000000..070e7b084 --- /dev/null +++ b/src/domain/javascriptStaticPathResolution.test.ts @@ -0,0 +1,264 @@ +import { posix } from "node:path"; + +import { parseExpression } from "@babel/parser"; +import { describe, expect, it } from "vitest"; + +import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js"; +import { + staticPath, + staticPathResolutionContext, +} from "./javascriptStaticAnalysisHelpers.js"; +import type { JavaScriptStaticPathContext } from "./javascriptStaticAnalysisTypes.js"; + +const absoluteParts = [ + ["/app", "/shared/preload.js"], + ["ignored", "/app", "preload.js"], + ["/app", "first", "/shared", "nested", "../preload.js"], + ["/app", "preload/"], + ["/app", "preload///"], + ["/app/", "./sub", "../preload.js"], + ["/app", ".."], + ["/app", "../../.."], + ["/"], + ["///"], + ["/app", "/", ""], + ["", "/app", "", "preload.js", ""], + ["/app", "..", "child", "..", "preload.js"], +]; + +const anchoredExpressions = [ + ['path.resolve(__dirname, "preload.cjs")', "preload.cjs"], + ['path.posix.resolve("ignored", __dirname, "preload.js")', "preload.js"], + ['path.resolve("/ignored", __dirname, "preload.js")', "preload.js"], + [ + 'path.posix.resolve("ignored", dirname(fileURLToPath(import.meta.url)), "preload.js")', + "preload.js", + ], + [ + 'path.resolve("ignored", path.dirname(__filename), "preload.js")', + "preload.js", + ], + ['path.resolve(__dirname, "sub", "../preload.js")', "preload.js"], + ['path.resolve(__dirname, "../preload.js")', "../preload.js"], + ['path.resolve(__dirname, "preload/")', "preload"], + ['path.resolve(__dirname, "sub", __dirname, "preload.js")', "preload.js"], + ['path.resolve(__dirname, "/shared", "preload.js")', "/shared/preload.js"], + [ + 'path.resolve(dirname(fileURLToPath(import.meta.url)), "/shared/preload.js")', + "/shared/preload.js", + ], + ["path.resolve(__dirname)", "."], + ['path.resolve(__dirname, "")', "."], + ['path.resolve(__dirname, "sub/../")', "."], + ['path.posix.resolve(`/app`, `/shared`, "preload.js")', "/shared/preload.js"], + ['path.posix.resolve("" + "/app", "preload.js")', "/app/preload.js"], + ['path.posix.resolve(`/` + `app`, "preload.js")', "/app/preload.js"], +] as const; + +const unknownExpressions = [ + "path.resolve()", + "path.posix.resolve()", + 'path.resolve("sub", "../preload.js")', + 'path.resolve("", "")', + 'path.resolve(runtimeBase, "/app/preload.js")', + 'path.resolve("/app", runtimeFile)', + 'path.resolve(runtimeBase, __dirname, "preload.js")', + "path.resolve(__dirname, runtimeFile)", + 'path.resolve(...parts, "/app/preload.js")', + 'path.resolve("/app", ...parts)', + 'path.resolve(42, "/app/preload.js")', + 'path.resolve("/app", null)', + "path.resolve(`/app/${runtimeFile}`)", + 'path.win32.resolve("/app", "/shared/preload.js")', + 'path.win32.resolve(__dirname, "preload.js")', + 'win32.resolve("/app", "preload.js")', + 'resolve("/app", "preload.js")', +]; + +describe("inert JavaScript path resolution", () => { + it.each(absoluteParts)( + "matches the POSIX resolve oracle for %j", + (...parts) => { + assertPathProjection( + `path.posix.resolve(${parts.map((part) => JSON.stringify(part)).join(", ")})`, + posix.resolve(...parts), + "filesystem-expression", + ); + }, + ); + + it.each(anchoredExpressions)( + "projects the source anchor in %s", + (expression, path) => { + assertPathProjection(expression, path, "filesystem-expression"); + }, + ); + + it.each([ + [ + 'path.join("/app", "/shared/preload.js")', + posix.join("/app", "/shared/preload.js"), + "filesystem-expression", + ], + [ + 'path.posix.join("/app", "preload/")', + posix.join("/app", "preload/"), + "filesystem-expression", + ], + [ + 'path.join("sub", "../preload.js")', + posix.join("sub", "../preload.js"), + "module-specifier", + ], + [ + 'path.join(__dirname, "preload.js")', + "preload.js", + "filesystem-expression", + ], + [ + 'path.join("ignored", __dirname, "preload.js")', + "ignored/preload.js", + "filesystem-expression", + ], + [ + 'path.join(dirname(fileURLToPath(import.meta.url)), "preload.js")', + "preload.js", + "filesystem-expression", + ], + ['join("sub", "preload.js")', "sub/preload.js", "module-specifier"], + ] as const)("preserves join behavior in %s", (expression, path, context) => { + assertPathProjection(expression, path, context); + }); + + it.each(unknownExpressions)("keeps unsupported %s unknown", (expression) => { + expect( + staticPath(parseExpression(expression, { sourceType: "module" })), + ).toBeUndefined(); + const { analysis, windowExpression, utilityExpression } = + analyzePathConsumers(expression); + expect(analysis.parse_status).toBe("partial"); + expect(analysis.parse_error_count).toBe(0); + expect(analysis.role_paths).toEqual([]); + expect(analysis.electron.browser_windows).toEqual([ + expect.objectContaining({ + preload_path: null, + preload_resolution_context: null, + web_preferences: [ + { + name: "preload", + value: { status: "dynamic", value: null, expression }, + }, + ], + location: lineRange(2, 0, windowExpression.length), + }), + ]); + expect(analysis.electron.utility_processes).toEqual([ + { + module_path: null, + module_resolution_context: null, + module_expression: expression, + service_name: null, + module_key: null, + location: lineRange(3, 0, utilityExpression.length), + }, + ]); + expect(analysis.limitations).toContain( + "One or more static keys, expressions, or Electron boundary values were dynamic and remain unknown.", + ); + }); + + it.each([ + "path.join()", + "path.join(__dirname)", + 'path.join("/app", runtimeFile)', + "path.join(...parts)", + ])("preserves unresolved join syntax in %s", (expression) => + expect( + staticPath(parseExpression(expression, { sourceType: "module" })), + ).toBeUndefined(), + ); +}); + +const analyzePathConsumers = (expression: string) => { + const property = `preload: ${expression}`; + const genericPrefix = "const options = { "; + const windowPrefix = "new BrowserWindow({ webPreferences: { "; + const windowExpression = `${windowPrefix}${property} } })`; + const utilityExpression = `utilityProcess.fork(${expression})`; + return { + property, + genericPrefix, + windowPrefix, + windowExpression, + utilityExpression, + analysis: analyzeJavaScriptStaticSource( + `${genericPrefix}${property} };\n${windowExpression};\n${utilityExpression};`, + ), + }; +}; + +const assertPathProjection = ( + expression: string, + path: string, + context: JavaScriptStaticPathContext, +) => { + const node = parseExpression(expression, { sourceType: "module" }); + expect(staticPath(node)).toBe(path); + expect(staticPathResolutionContext(node)).toBe(context); + const { + analysis, + property, + genericPrefix, + windowPrefix, + windowExpression, + utilityExpression, + } = analyzePathConsumers(expression); + expect(analysis.parse_status).toBe("complete"); + expect(analysis.parse_error_count).toBe(0); + expect(analysis.role_paths).toEqual( + ( + [ + [1, genericPrefix.length], + [2, windowPrefix.length], + ] as const + ).map(([line, column]) => ({ + role: "preload", + path, + resolution_context: context, + mechanism: "property:preload", + module_key: null, + location: lineRange(line, column, column + property.length), + })), + ); + expect(analysis.electron.browser_windows).toEqual([ + { + options_status: "object-literal", + web_preferences_status: "object-literal", + web_preferences: [ + { + name: "preload", + value: { status: "literal", value: path, expression: null }, + }, + ], + preload_path: path, + preload_resolution_context: context, + module_key: null, + location: lineRange(2, 0, windowExpression.length), + }, + ]); + expect(analysis.electron.utility_processes).toEqual([ + { + module_path: path, + module_resolution_context: context, + module_expression: null, + service_name: null, + module_key: null, + location: lineRange(3, 0, utilityExpression.length), + }, + ]); +}; + +const lineRange = (line: number, start: number, end: number) => ({ + start: { line, column: start }, + end: { line, column: end }, +});