feat: Transitive dependencies for javascript #171

TamarW0 · 2025-12-29T09:40:32Z

No description provided.

zvigrinberg · 2025-12-29T11:45:43Z

/test-heavy

tmihalac

Its looks good, I added a few small comments

tmihalac · 2025-12-29T12:44:00Z

src/exploit_iq_commons/utils/functions_parsers/javascript_functions_parser.py

+        content = function.page_content
+
+        if not self.is_function(function):
+            raise ValueError('Only function document is supported')


Do we want to raise an error here, or write to logs and continue?

actually it is not an expected behavior,
if not function doc was sent we need to debug and understand why
if it will only write to log we might miss the error

src/vuln_analysis/utils/functions_parsers/javascript_functions_parser.py

src/exploit_iq_commons/utils/functions_parsers/javascript_functions_parser.py

src/vuln_analysis/utils/functions_parsers/javascript_functions_parser.py

tmihalac · 2025-12-31T13:26:03Z

LGTM

RedTanny

LGTM

TamarW0 · 2026-01-03T23:06:41Z

/tests

appeng-dev03-ci · 2026-01-03T23:07:25Z

Caution

There are some errors in your PipelineRun template.

PipelineRun	Error
vulnerability-analysis-on-pr	`CEL expression evaluation error: expression "event == \"pull_request\" &&\n!body.pull_request.draft &&\n(target_branch == \"main\" \|\| target_branch == \"rh-aiq-main\") &&\n(\"src/\".pathChanged() \|\| \"metrics_lib/\".pathChanged() \|\| \"pyproject.toml\".pathChanged() \|\| \"uv.lock\".pathChanged() \|\| \"Dockerfile\".pathChanged() \|\| \".dockerignore\".pathChanged())\n" failed to evaluate: no such key: pull_request`

zvigrinberg · 2026-01-04T05:41:55Z

/test vulnerability-analysis-on-pr

zvigrinberg

Hi @TamarW0
Thanks for you efforts, Great job in overall!!
Please see my comments, i have several questions and comments.

In addition, Three missing essential things:

You need to install NodeJS and npm ( usually npm shipped together with NodeJS) in the Dockerfile => File https://github.com/RHEcosystemAppEng/vulnerability-analysis/blob/59f0f48233972998bd62b6f0aeeeb50790ff8a50/Dockerfile
Better to install the versions that you used or NodeJS LTS.

What about the file extensions ( inclusion and exclusions needed for a NodeJS project analysis?, you need to update that as well ( better also to update it UI Client Application), Let me know what they're going to be , So I Will also create the javascript template in Integration tests accordingly .

vulnerability-analysis/kustomize/base/includes.json

Lines 16 to 29 in 59f0f48

    
           "JavaScript": [ 
        
             "**/*.js", 
        
             "**/*.jsx", 
        
             "webpack.config.js", 
        
             "rollup.config.js", 
        
             "babel.config.js", 
        
             ".babelrc", 
        
             ".eslintrc.js", 
        
             ".eslintrc.json", 
        
             "tsconfig.json", 
        
             "*.config.js", 
        
             "*.config.json", 
        
             "public/**/*", 
        
             "src/**/*"

vulnerability-analysis/kustomize/base/excludes.json

Lines 29 to 39 in 59f0f48

    
           "JavaScript": [ 
        
             "node_modules/**/*", 
        
             "dist/**/*", 
        
             "build/**/*", 
        
             "test/**/*", 
        
             "tests/**/*", 
        
             "example/**/*", 
        
             "examples/**/*", 
        
             "package.json", 
        
             "package-lock.json", 
        
             "yarn.lock"

Kidnly rebase your work on top of main ( to fetch in the integration tests I've added to the CI of the repository) , and add your Javascript IT test case to here: https://github.com/RHEcosystemAppEng/vulnerability-analysis/blob/main/ci/it/integration-tests-input.json#L4-L93

src/vuln_analysis/tools/tests/test_transitive_code_search.py

src/exploit_iq_commons/utils/javascript_extended_segmenter.py

zvigrinberg · 2026-01-07T07:40:29Z

src/exploit_iq_commons/utils/functions_parsers/javascript_functions_parser.py

+    def supported_files_extensions(self) -> list[str]:
+        return ['.js', '.mjs', '.cjs']


@TamarW0 Did you decide to support html files only in a later/future iteration of this enhancement?
I think in that same opportunity, It's good also to handle jsx files of react as well. ( and this will extend the support also for frontend/web applications as well ( not only NodeJS).
Please create a new ticket for this future work.

src/exploit_iq_commons/utils/functions_parsers/javascript_functions_parser.py

src/vuln_analysis/utils/functions_parsers/javascript_functions_parser.py

zvigrinberg · 2026-01-07T07:59:21Z

src/exploit_iq_commons/utils/functions_parsers/javascript_functions_parser.py

+
+        return False
+
+    def _is_subclass_of(self, child_class: str, parent_class: str, code_documents: dict[str, Document]) -> bool:


@TamarW0 Are you fully supports inheritance of classes ? I haven't checked deeply yet.

I added the support in transitive and prototype inheritance.
I didn't support variables inheritance, as we can not know the type of the variable anyway so I think it doesn't give us more info
is it make more sense now?

@TamarW0 OK that's good. ( prototype inheritance should get methods of super classes as well).
I Think that for typescript in the future, this would be a a very good addition... ( or maybe also for javascript that it will use d.ts files of libs of nodejs for types)
Please create a jira ticket for it ( once Jira tracker is up and running again) for future tracking , to be handled in a future iteration, 10x!.

src/vuln_analysis/utils/functions_parsers/javascript_functions_parser.py

zvigrinberg

@TamarW0 Great work!
Just go over all comments, and open tickets for opened items (planned for future iterations) before merging.
Thanks!.
Also try to add another test for IT testing, as discussed.
LGTM Approved.

TamarW0 requested review from RedTanny, tmihalac and zvigrinberg December 29, 2025 11:30

tmihalac reviewed Dec 29, 2025

View reviewed changes

TamarW0 force-pushed the APPENG-2960-javascript branch 2 times, most recently from ca11846 to 6bb533c Compare December 31, 2025 12:37

RedTanny approved these changes Dec 31, 2025

View reviewed changes

TamarW0 added the WIP label Jan 1, 2026

zvigrinberg requested changes Jan 7, 2026

View reviewed changes

TamarW0 force-pushed the APPENG-2960-javascript branch from 49a8521 to ed1aee8 Compare January 13, 2026 19:30

Tamar Weisskopf added 15 commits January 18, 2026 11:56

feat: Transitive dependencies for javascript

e2b84e2

refactoring tests

a27fe22

feat: Transitive dependencies for javascript

5a81349

fixes after review

3a5cb87

change splitting lines logic

27885c0

extract normalization logic into helper function

6181f00

fix: typo

7854533

Support Callback References Without Parentheses in JavaScript Parser

a3a64ad

support calles from the same class

d62c598

Support class inheritance and mixins in call chains

917aed7

tests to _is_subclass_of function

1a65dd9

fix to support npm v3+

5e40090

fix the tests acording to last changes in logic

2685377

another review iteration fix

2db347e

fixes after rebase

dc92a59

Tamar Weisskopf added 7 commits January 18, 2026 11:56

fix more imports due to rebase

4a25e8c

fix more imports due to rebase

f7fb2db

Add xz-utils to docker

e9e447c

Add xz-utils to docker

f9723dd

add javascript test case to intergration tests

b043df3

add support in objects

628bb42

enhance _is_subclass_of with transitive and prototype inheritance

daefbcc

TamarW0 force-pushed the APPENG-2960-javascript branch from 6b466e8 to daefbcc Compare January 18, 2026 09:56

zvigrinberg approved these changes Jan 20, 2026

View reviewed changes

	"JavaScript": [
	"*/.js",
	"*/.jsx",
	"webpack.config.js",
	"rollup.config.js",
	"babel.config.js",
	".babelrc",
	".eslintrc.js",
	".eslintrc.json",
	"tsconfig.json",
	"*.config.js",
	"*.config.json",
	"public/*/",
	"src/*/"

	"JavaScript": [
	"node_modules/*/",
	"dist/*/",
	"build/*/",
	"test/*/",
	"tests/*/",
	"example/*/",
	"examples/*/",
	"package.json",
	"package-lock.json",
	"yarn.lock"

		def supported_files_extensions(self) -> list[str]:
		return ['.js', '.mjs', '.cjs']


		return False

		def _is_subclass_of(self, child_class: str, parent_class: str, code_documents: dict[str, Document]) -> bool:

feat: Transitive dependencies for javascript #171

Are you sure you want to change the base?

feat: Transitive dependencies for javascript #171

Uh oh!

Conversation

TamarW0 commented Dec 29, 2025

Uh oh!

zvigrinberg commented Dec 29, 2025

Uh oh!

tmihalac left a comment

Choose a reason for hiding this comment

Uh oh!

tmihalac Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

TamarW0 Dec 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tmihalac commented Dec 31, 2025

Uh oh!

RedTanny left a comment

Choose a reason for hiding this comment

Uh oh!

TamarW0 commented Jan 3, 2026

Uh oh!

appeng-dev03-ci bot commented Jan 3, 2026

Uh oh!

zvigrinberg commented Jan 4, 2026

Uh oh!

zvigrinberg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

zvigrinberg Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

zvigrinberg Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

TamarW0 Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

zvigrinberg Jan 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zvigrinberg left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zvigrinberg left a comment •

edited

Loading

zvigrinberg left a comment •

edited

Loading