search

cs-au-dk / jelly

JavaScript/TypeScript static analyzer for call graph construction, library usage pattern matching, and vulnerability exposure analysis
MIT License
325 stars 25 forks source link

feat: analysis support for builtin modules #8

Open werifu opened 1 year ago

werifu commented 1 year ago

Hi @amoeller , I have done some work on supporting builtin modules of Node.js using an approach of mock as what you have taught me at last meeting.

I'm not sure if it's correct to mock the APIs by the method in my code, therefore I only wrote 4 modules related with module 'http' at the moment and I hope you could review it.

Please let me introduce what I have done in this PR:

  1. in src/analysis/operation.ts: I removed the code about adding Unknown Access Path for builtin modules since it would be handled correctly when resolving the file.
  2. in src/misc/files.ts: the function resolveBultinModule would do what tsResolveModuleName does but only for builtin modules.
  3. in src/packagejson.ts: I processed the package information of builtin modules shown on the graph.
  4. in src/mockbuiltin/*.js: They are the mock APIs of respective builtin modules, all functions and methods in them do the same thing: treating all arguments as functions and call them so that callbacks passed into the APIs would be called in user's code. Since we will not execute the code in mockbuiltin, we don't need to consider potential runtime errors.

I'm now still working for the rest APIs in builtin modules, but I need your advice before I continue this work in order to avoid meaningless work... It also bothers me that how can I perform unit tests on all mocked APIs to guarantee the correctness.

I will appreciate it a lot If you could review my code and instruct me in this PR.