phylum-dev / vuln-reach

A library for building tools to determine if vulnerabilities are reachable in a code base.

Home Page:https://phylum.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Shorthand identifiers are not handled correctly

andreaphylum opened this issue · comments

JavaScript has a concept of shorthand identifiers in object constructors and patterns, where { foo } is equivalent to { foo: foo }. Those nodes do not have a kind of identifier, but of shorthand_property_identifier or shorthand_property_identifier_pattern.

We currently do not handle those correctly in all cases; their semantics are not trivial, though, and would require some research to figure out correctly.