Repository navigation
Reachables for frontend apps without an SBOM - #279
Merged
Merged
Conversation
…tend (work in progress)
… predicate results (work in progress)
…s the one real flow (work in progress)
…th the source call around a lowered template
… returns are no sinks isUnsunkFlow counted the source node's tags, so a parameter tagged both framework-input and http (a sink tag) made a flow to a read of itself a finding. A method tagged framework-data (a route's load or loader) hands its return value to its page; collectDefaultTagFlows no longer treats that return as a sink. A frontend test pins it: a load's data, a JSON response and a response's id in the next request path report nothing, a parameter served as text/html does.
prabhu
added
enhancement
prabhu
enabled auto-merge
October 12, 2026 16:31
… queue The queue only waits for required checks, and until now that was the ubuntu-only testing job, so a merge could land while Windows or macOS was red. Add a pr-tests matrix (windows-latest, macos-latest) that builds chen from main and runs scalafmtCheck, test, stage and createDistribution - the same core as testing without the repo-scan battery, native-image and SBOM steps, to keep queue builds fast. Ubuntu stays covered by testing itself.
IncludePathEnvTests drove includePathsFrom with windows = false over real temp paths, which on Windows are drive-letter paths: ': '-splitting those yields fragments that are no directory, so the assertions saw an empty set. The platform's own separator mode is used for the portable assertions and the ':'-splitting cases stay on non-Windows runners, where no drive letters need protecting. MemorySafetyCommandTests fed the POSIX absolute /usr/include/string.h and expected a file: URI; on Windows Paths.get of that is not absolute but current-drive-relative, so it came out as the relative usr/include/string.h under %SRCROOT%. The outside-the-input file is now the platform's own absolute path, and the URI is asserted by its file:/ prefix and string.h suffix, which hold on both.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is atom's side of the frontend framework tagging in AppThreat/chen#201. With chen tagging sources and sinks itself, reachables needed a few JavaScript-only filters so that what it reports are findings:
--no-ast-cachenow also disables the JS AST and astgen caches, identifiers inside lowered template literals are shown with the call around them, and the CI images install atom-parsetools 1.10.1 (AppThreat/atom-parsetools#18). New workflow tests cover Angular, plain DOM, Next.js server actions and SvelteKit handlers without an SBOM.Needs AppThreat/chen#201 released first.