fix: check imports from virtual modules

[AndreyYolkin]

Closes #411

Normalize the \0 (Rollup, Rolldown) and /\0 (Rspack) marker of virtual module for importer filter matching, keeping the original importer id for error messages

Summary by CodeRabbit

• Bug Fixes
  • Corrected how virtual module IDs are handled during import filtering, so valid imports aren’t mistakenly blocked and configured restrictions are applied consistently.
• Tests
  • Added coverage for virtual module imports, including importer IDs with embedded null bytes and include/exclude filtering.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5271198e-d0f0-4589-8759-7ba791272465

📥 Commits

Reviewing files that changed from the base of the PR and between 8d192c7 and 606f8aa.

📒 Files selected for processing: 2

• src/index.ts
• test/index.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The importer filter now normalizes IDs that begin with \0 or /\0 before applying the matcher. Tests cover denied imports, excluded virtual imports, and IDs with embedded null bytes.

Changes: Virtual module import filtering

Layer / File(s)	Summary
Normalize and verify virtual module IDs src/index.ts, test/index.test.ts	includes removes the leading null byte from \0-prefixed IDs and from the null-byte portion of /\0-prefixed IDs before filtering. Tests cover blocked imports, warning and proxy behavior, embedded null bytes, and include filtering.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 606f8

The change enables configured import filters to match supported virtual-module IDs, with no concrete material issue established that requires resolution before merging.

Security architecture risk: ⚪ Minimal · up to 606f8

The change makes existing import restrictions apply to supported virtual modules without adding permissions or widening access. No material security risk introduced or worsened by this change was identified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected security scope is import-policy enforcement within the consuming build. Importer identifiers supplied through bundler hooks can newly reach configured checks, but the change introduces no additional credentials, tenant authority, network access or persistent-state ownership.

Trust Boundaries and Controls

• inferred — The normalization is confined to policy eligibility rather than module resolution or identity. An importer bearing a supported virtual marker must still pass the configured include/exclude filter and existing target-pattern checks; explicit exclusions and callback behavior remain configuration-controlled exceptions, not newly introduced bypasses.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: checking imports from virtual modules.
Linked Issues check		Issue #411 requires forbidden imports from Rollup and Rolldown virtual modules to fail. The PR normalizes leading \\0 importer IDs before importer-filter matching. The added tests cover denied import…
Out of Scope Changes check		The changes are limited to virtual-module importer normalization in src/index.ts and focused tests in test/index.test.ts. The Rspack case, embedded null-byte case, and include filtering tests va…

Full details: Linked Issues check

Explanation

Issue #411 requires forbidden imports from Rollup and Rolldown virtual modules to fail. The PR normalizes leading \0 importer IDs before importer-filter matching. The added tests cover denied imports from Rollup virtual modules. The change also covers the /\0 Rspack form without changing the original importer ID used for reporting.

Full details: Out of Scope Changes check

Explanation

The changes are limited to virtual-module importer normalization in src/index.ts and focused tests in test/index.test.ts. The Rspack case, embedded null-byte case, and include filtering tests validate the same importer-filter behavior. No unrelated production behavior is shown.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}