fix: estree-ast-utils

NodeSecure · May 16, 2024 · 347036e · 347036e
1 parent 19e891a
commit 347036e
Show file tree

Hide file tree

Showing 4 changed files with 25 additions and 14 deletions.
diff --git a/workspaces/estree-ast-utils/src/utils/VariableTracer.js b/workspaces/estree-ast-utils/src/utils/VariableTracer.js
@@ -81,7 +81,6 @@ export class VariableTracer extends EventEmitter {
       moduleName
     });
 
-
     if (identifierOrMemberExpr.includes(".")) {
       const exprs = [...getSubMemberExpressionSegments(identifierOrMemberExpr)]
         .filter((expr) => !this.#traced.has(expr));
@@ -428,7 +427,7 @@ export class VariableTracer extends EventEmitter {
 
     let superClassMemory = [superClass.name];
     const data = this.getDataFromIdentifier(superClass.name);
-    if (!superClassMemory.includes("RegExp")) {
+    if (!superClassMemory.includes("RegExp") && data?.superClassMemory) {
       superClassMemory = [...superClassMemory, ...data.superClassMemory];
     }
 

diff --git a/workspaces/estree-ast-utils/test/VariableTracer/VariableTracer.spec.js b/workspaces/estree-ast-utils/test/VariableTracer/VariableTracer.spec.js
@@ -30,7 +30,8 @@ test("it should be able to Trace a malicious code with Global, BinaryExpr, Assig
   assert.deepEqual(evil, {
     name: "require",
     identifierOrMemberExpr: "process.mainModule.require",
-    assignmentMemory: ["p", "evil"]
+    assignmentMemory: ["p", "evil"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -58,7 +59,8 @@ test("it should be able to Trace a malicious CallExpression by recombining segme
   assert.deepEqual(evil, {
     name: "require",
     identifierOrMemberExpr: "process.mainModule.require",
-    assignmentMemory: ["g", "r", "c"]
+    assignmentMemory: ["g", "r", "c"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 3);
 
@@ -117,7 +119,8 @@ test("it should be able to Trace an unsafe crypto.createHash using Function.prot
   assert.deepEqual(createHashBis, {
     name: "crypto.createHash",
     identifierOrMemberExpr: "crypto.createHash",
-    assignmentMemory: ["crr", "createHashBis"]
+    assignmentMemory: ["crr", "createHashBis"],
+    superClassMemory: []
   });
 
   assert.strictEqual(helpers.tracer.importedModules.has("crypto"), true);

diff --git a/workspaces/estree-ast-utils/test/VariableTracer/assignments.spec.js b/workspaces/estree-ast-utils/test/VariableTracer/assignments.spec.js
@@ -19,7 +19,8 @@ test("it should be able to Trace a require Assignment (using a global variable)"
   assert.deepEqual(foo, {
     name: "require",
     identifierOrMemberExpr: "require",
-    assignmentMemory: ["foo"]
+    assignmentMemory: ["foo"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 1);
 
@@ -41,7 +42,8 @@ test("it should be able to Trace a require Assignment (using a MemberExpression)
   assert.deepEqual(foo, {
     name: "require",
     identifierOrMemberExpr: "require.resolve",
-    assignmentMemory: ["foo"]
+    assignmentMemory: ["foo"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 1);
 
@@ -65,7 +67,8 @@ test("it should be able to Trace a global Assignment using an ESTree ObjectPatte
   assert.deepEqual(boo, {
     name: "require",
     identifierOrMemberExpr: "process.mainModule.require",
-    assignmentMemory: ["yoo", "boo"]
+    assignmentMemory: ["yoo", "boo"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -92,7 +95,8 @@ test("it should be able to Trace an Unsafe Function() Assignment using an ESTree
   assert.deepEqual(boo, {
     name: "require",
     identifierOrMemberExpr: "process.mainModule.require",
-    assignmentMemory: ["yoo", "boo"]
+    assignmentMemory: ["yoo", "boo"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -136,7 +140,8 @@ test("it should be able to Trace a global assignment using a LogicalExpression",
   assert.deepEqual(foo, {
     name: "require",
     identifierOrMemberExpr: "require",
-    assignmentMemory: ["foo"]
+    assignmentMemory: ["foo"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 1);
 

diff --git a/workspaces/estree-ast-utils/test/VariableTracer/cryptoCreateHash.spec.js b/workspaces/estree-ast-utils/test/VariableTracer/cryptoCreateHash.spec.js
@@ -26,7 +26,8 @@ test("it should be able to Trace crypto.createHash when imported with an ESTree
   assert.deepEqual(createHashBis, {
     name: "crypto.createHash",
     identifierOrMemberExpr: "crypto.createHash",
-    assignmentMemory: ["cryptoBis", "createHashBis"]
+    assignmentMemory: ["cryptoBis", "createHashBis"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -62,7 +63,8 @@ test("it should be able to Trace createHash when required (CommonJS) and destruc
   assert.deepEqual(createHashBis, {
     name: "crypto.createHash",
     identifierOrMemberExpr: "crypto.createHash",
-    assignmentMemory: ["createHash", "createHashBis"]
+    assignmentMemory: ["createHash", "createHashBis"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -94,7 +96,8 @@ test("it should be able to Trace crypto.createHash when imported with an ESTree
   assert.deepEqual(createHashBis, {
     name: "crypto.createHash",
     identifierOrMemberExpr: "crypto.createHash",
-    assignmentMemory: ["createHash", "createHashBis"]
+    assignmentMemory: ["createHash", "createHashBis"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);
 
@@ -130,7 +133,8 @@ test("it should be able to Trace crypto.createHash with CommonJS require and wit
   assert.deepEqual(createHashBis, {
     name: "crypto.createHash",
     identifierOrMemberExpr: "crypto.createHash",
-    assignmentMemory: ["createHashBis"]
+    assignmentMemory: ["createHashBis"],
+    superClassMemory: []
   });
   assert.strictEqual(assignments.length, 2);