phylum-dev / vuln-reach

A library for building tools to determine if vulnerabilities are reachable in a code base.

Home Page:https://phylum.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Reachability is incorrect for assignments

cd-work opened this issue · comments

Currently when reassigning a function name, its access graphs appear to be correct but the reachability is not computed correctly.

function foo() { }

renamed = foo;

function bar() {
    renamed();
}

In the above example, foo should be reachable from bar, but it is not.

There is already a test in vuln-reach which is currently ignored:

javascript::lang::accesses::tests::renamed_function