Merge remote-tracking branch 'origin/main' into eas-3876-manifest-secrets

Author: snarayan2-atlas

crates/forge_analyzer/src/checkers.rs

@@ -997,6 +997,18 @@ impl<'cx> Runner<'cx> for SecretChecker {
                                 SecretVuln::new(interp.callstack(), interp.env(), interp.entry());
                             info!("Found a vuln!");
                             self.vulns.push(vuln);
+                        } else if let Some(Value::Const(_) | Value::Phi(_)) = interp.get_value(
+                            def,
+                            *varid,
+                            projvec_from_str("X-Automation-Webhook-Token").into(),
+                        ) && interp
+                            .get_value(def, *varid_argument, Some(projvec_from_str("method")))
+                            .is_some_and(|x| *x == *"POST")
+                        {
+                            let vuln =
+                                SecretVuln::new(interp.callstack(), interp.env(), interp.entry());
+                            info!("Webhook token found!");
+                            self.vulns.push(vuln);
                         }
                     }
                 }

crates/forge_analyzer/src/definitions.rs

@@ -3450,8 +3450,22 @@ impl Visit for GlobalCollector<'_> {
         let mut all_module_items = Vec::new();
 
         for item in &n.body {
-            if let ModuleItem::Stmt(stmt) = item {
-                all_module_items.push(stmt.clone());
+            match item {
+                // TODO handle all cases
+                ModuleItem::Stmt(stmt) => all_module_items.push(stmt.clone()),
+                ModuleItem::ModuleDecl(mod_decl) => match mod_decl {
+                    ModuleDecl::ExportDecl(export_decl) => {
+                        all_module_items.push(Stmt::Decl(export_decl.decl.clone()))
+                    }
+                    ModuleDecl::ExportAll(_)
+                    | ModuleDecl::ExportDefaultDecl(_)
+                    | ModuleDecl::ExportDefaultExpr(_)
+                    | ModuleDecl::ExportNamed(_)
+                    | ModuleDecl::TsExportAssignment(_)
+                    | ModuleDecl::Import(_)
+                    | ModuleDecl::TsImportEquals(_)
+                    | ModuleDecl::TsNamespaceExport(_) => {}
+                },
             }
         }
         analyzer.lower_stmts(all_module_items.as_slice());
@@ -4251,3 +4265,37 @@ impl PartialEq<str> for ImportKind {
         }
     }
 }
+
+impl PartialEq<str> for Value {
+    #[inline]
+    fn eq(&self, other: &str) -> bool {
+        match self {
+            Self::Const(Const::Literal(s)) => **s == *other,
+            Self::Phi(v) if !v.is_empty() => v.iter().all(|x| *x == *other),
+            Self::Uninit | Self::Unknown | Self::Object(_) | Self::Phi(_) => false,
+        }
+    }
+}
+
+impl PartialEq<Value> for str {
+    #[inline]
+    fn eq(&self, other: &Value) -> bool {
+        *other == *self
+    }
+}
+
+impl PartialEq<str> for Const {
+    #[inline]
+    fn eq(&self, other: &str) -> bool {
+        match self {
+            Self::Literal(s) => **s == *other,
+        }
+    }
+}
+
+impl PartialEq<Const> for str {
+    #[inline]
+    fn eq(&self, other: &Const) -> bool {
+        *other == *self
+    }
+}

crates/forge_analyzer/src/interp.rs

@@ -795,6 +795,10 @@ impl<'cx, C: Runner<'cx>> Interp<'cx, C> {
                     None => {
                         if self.is_obj(varid) {
                             Value::Object(varid)
+                        } else if let Some(defid) = self.body().get_defid_from_var(varid)
+                            && let Some(val) = self.value_manager.defid_to_value.get(&defid)
+                        {
+                            val.clone()
                         } else {
                             Value::Unknown
                         }
@@ -947,11 +951,13 @@ impl<'cx, C: Runner<'cx>> Interp<'cx, C> {
         let mut dataflow = C::Dataflow::with_interp(self);
         let mut worklist = WorkList::new();
 
+        // funcs then are pushed after
+        worklist.push_front_blocks(self.env, func_def, self.call_all);
+
+        // global should be first
         for global_def in &self.env().global {
             worklist.push_front_blocks(self.env, *global_def, self.call_all);
         }
-
-        worklist.push_front_blocks(self.env, func_def, self.call_all);
         let old_body = self.curr_body.get();
         while let Some((def, block_id)) = worklist.pop_front() {
             let arguments = self.callstack_arguments.pop();

crates/forge_analyzer/src/runners.rs

@@ -1,3 +1,4 @@
+#![allow(dead_code, unused)]
 use std::{
     borrow::Borrow,
     collections::{BTreeSet, HashSet},
@@ -165,6 +166,7 @@ struct ContentAction<'a> {
     #[serde(flatten, borrow)]
     common_keys: CommonKey<'a>,
 }
+
 #[derive(Default, Debug, Clone, PartialEq, Eq, Deserialize)]
 struct ContentByLineItem<'a> {
     #[serde(flatten, borrow)]