phylum-dev / vuln-reach

A library for building tools to determine if vulnerabilities are reachable in a code base.

Home Page:https://phylum.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Validate whether kind check in `compute_paths` is redundant

andreaphylum opened this issue · comments

In the AccessGraph::compute_paths method, we currently only append an accessor on the BFS queue if it is of kind identifier. This is correct because reachability is only computed between identifier nodes.

Is the check redundant?

In the current implementation of AccessGraph::find_accessor we only ever emit identifier nodes, with only one potential exception.

We should check against the JS grammar if that expression could ever result in a node which is not of kind identifier. If it can't, we should consider removing that check or turning it into an assertion.