TIWFY26Q2-26 : global perm bug

crates/forge_analyzer/src/checkers.rs

@@ -1,3 +1,4 @@
+#![allow(dead_code, unused)]
 use crate::interp::ProjectionVec;
 use crate::utils::projvec_from_str;
 use crate::{

crates/forge_analyzer/src/definitions.rs

@@ -3450,8 +3450,22 @@ impl Visit for GlobalCollector<'_> {
         let mut all_module_items = Vec::new();
 
         for item in &n.body {
-            if let ModuleItem::Stmt(stmt) = item {
-                all_module_items.push(stmt.clone());
+            match item {
+                // TODO handle all cases
+                ModuleItem::Stmt(stmt) => all_module_items.push(stmt.clone()),
+                ModuleItem::ModuleDecl(mod_decl) => match mod_decl {
+                    ModuleDecl::ExportDecl(export_decl) => {
+                        all_module_items.push(Stmt::Decl(export_decl.decl.clone()))
+                    }
+                    ModuleDecl::ExportAll(_)
+                    | ModuleDecl::ExportDefaultDecl(_)
+                    | ModuleDecl::ExportDefaultExpr(_)
+                    | ModuleDecl::ExportNamed(_)
+                    | ModuleDecl::TsExportAssignment(_)
+                    | ModuleDecl::Import(_)
+                    | ModuleDecl::TsImportEquals(_)
+                    | ModuleDecl::TsNamespaceExport(_) => {}
+                },
             }
         }
         analyzer.lower_stmts(all_module_items.as_slice());

crates/forge_analyzer/src/interp.rs

@@ -795,6 +795,10 @@ impl<'cx, C: Runner<'cx>> Interp<'cx, C> {
                     None => {
                         if self.is_obj(varid) {
                             Value::Object(varid)
+                        } else if let Some(defid) = self.body().get_defid_from_var(varid)
+                            && let Some(val) = self.value_manager.defid_to_value.get(&defid)
+                        {
+                            val.clone()
                         } else {
                             Value::Unknown
                         }
@@ -947,11 +951,13 @@ impl<'cx, C: Runner<'cx>> Interp<'cx, C> {
         let mut dataflow = C::Dataflow::with_interp(self);
         let mut worklist = WorkList::new();
 
+        // funcs then are pushed after
+        worklist.push_front_blocks(self.env, func_def, self.call_all);
+
+        // global should be first
         for global_def in &self.env().global {
             worklist.push_front_blocks(self.env, *global_def, self.call_all);
         }
-
-        worklist.push_front_blocks(self.env, func_def, self.call_all);
         let old_body = self.curr_body.get();
         while let Some((def, block_id)) = worklist.pop_front() {
             let arguments = self.callstack_arguments.pop();

crates/forge_loader/src/manifest.rs

@@ -1,3 +1,4 @@
+#![allow(dead_code, unused)]
 use std::{
     borrow::Borrow,
     collections::{BTreeSet, HashSet},
@@ -164,6 +165,7 @@ struct ContentAction<'a> {
     #[serde(flatten, borrow)]
     common_keys: CommonKey<'a>,
 }
+
 #[derive(Default, Debug, Clone, PartialEq, Eq, Deserialize)]
 struct ContentByLineItem<'a> {
     #[serde(flatten, borrow)]

crates/fsrt/src/test.rs

@@ -1230,6 +1230,201 @@ fn graphql_compass() {
     dbg!(scan_result.into_vulns()[0].description());
 }
 
+#[test]
+fn global_secret_vuln() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "// src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route, fetch } from '@forge/api';
+        import graphqlGateway from '@atlassian/forge-graphql';
+
+        const secret = 'test';
+
+        const App = () => {
+            let value = 'value'
+
+            let h = { headers: { authorization: secret } }
+
+            fetch('url', h)
+            foo();
+
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+        export const run = render(<Macro app={<App />} />)
+        // manifest.yaml
+        modules:
+          macro:
+            - key: basic-hello-world
+              function: main
+              title: basic
+              handler: nothing
+              description: Inserts Hello world!
+          function:
+            - key: main
+              handler: index.run
+        app:
+          id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+          scopes:
+            - read:component:compass",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_secret_vuln(1));
+    assert!(scan_result.contains_vulns(1));
+}
+
+#[test]
+fn global_secret_no_vuln() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "// src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route, fetch } from '@forge/api';
+        import graphqlGateway from '@atlassian/forge-graphql';
+
+        const secret = process.env.SECRET;
+
+        const App = () => {
+            let value = 'value'
+
+            let h = { headers: { authorization: secret } }
+
+            fetch('url', h)
+            foo();
+
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+        export const run = render(<Macro app={<App />} />)
+        // manifest.yaml
+        modules:
+          macro:
+            - key: basic-hello-world
+              function: main
+              title: basic
+              handler: nothing
+              description: Inserts Hello world!
+          function:
+            - key: main
+              handler: index.run
+        app:
+          id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+          scopes:
+            - read:component:compass",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_vulns(0));
+}
+
+#[test]
+fn global_secret_vuln_reset() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "// src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route, fetch } from '@forge/api';
+        import graphqlGateway from '@atlassian/forge-graphql';
+
+        const secret = 'test';
+
+        const App = () => {
+            let value = 'value'
+
+            let h = { headers: { authorization: secret } }
+
+            let secret = process.ENV.secret;
+
+            fetch('url', h)
+            foo();
+
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+        export const run = render(<Macro app={<App />} />)
+        // manifest.yaml
+        modules:
+          macro:
+            - key: basic-hello-world
+              function: main
+              title: basic
+              handler: nothing
+              description: Inserts Hello world!
+          function:
+            - key: main
+              handler: index.run
+        app:
+          id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+          scopes:
+            - read:component:compass",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_vulns(0));
+}
+
+#[test]
+fn global_secret_vuln_alternate_file() {
+    let test_forge_project = MockForgeProject::files_from_string(
+        "//src/constants.tsx
+
+        export const secret = 'SECRET'
+
+        //src/index.tsx
+        import ForgeUI, { render, Fragment, Macro, Text } from '@forge/ui';
+        import api, { route, fetch } from '@forge/api';
+        import { secret } from './constants';
+        import graphqlGateway from '@atlassian/forge-graphql';
+
+        const App = () => {
+            let value = 'value'
+
+            let h = { headers: { authorization: secret } }
+
+            fetch('url', h)
+            foo();
+
+            return (
+                <Fragment>
+                <Text>Hello world!</Text>
+                </Fragment>
+            );
+        };
+        export const run = render(<Macro app={<App />} />)
+        // manifest.yaml
+        modules:
+          macro:
+            - key: basic-hello-world
+              function: main
+              title: basic
+              handler: nothing
+              description: Inserts Hello world!
+          function:
+            - key: main
+              handler: index.run
+        app:
+          id: ari:cloud:ecosystem::app/07b89c0f-949a-4905-9de9-6c9521035986
+        permissions:
+          scopes:
+            - read:component:compass",
+    );
+
+    let scan_result = scan_directory_test(test_forge_project);
+    assert!(scan_result.contains_secret_vuln(1));
+    assert!(scan_result.contains_vulns(1));
+}
+
 #[test]
 fn graphqlgateway_compass() {
     let test_forge_project = MockForgeProject::files_from_string(