Symbol table fails to parse functions with comments between formal parameters and body
andreaphylum opened this issue · comments
The symbol table builder assumes that a formal_parameter
list is always immediately contiguous to a statement_block
.
There are cases where this is not true, for example when a comment appears between the parameter list and the function body.
The assumption should be relaxed.
Example:
function ok(arg1, arg2) { }
function bad(arg1, arg2) /* comment */ { }
function_declaration [0, 0] - [0, 27]
name: identifier [0, 9] - [0, 11]
parameters: formal_parameters [0, 11] - [0, 23]
identifier [0, 12] - [0, 16]
identifier [0, 18] - [0, 22]
body: statement_block [0, 24] - [0, 27]
function_declaration [1, 0] - [1, 42]
name: identifier [1, 9] - [1, 12]
parameters: formal_parameters [1, 12] - [1, 24]
identifier [1, 13] - [1, 17]
identifier [1, 19] - [1, 23]
comment [1, 25] - [1, 38] <-- this causes a panic.
body: statement_block [1, 39] - [1, 42]
Affected code: https://github.com/phylum-dev/vuln-reach/blob/main/vuln-reach/src/javascript/lang/symbol_table.rs#L113-L119