fix(registry): restrict same-module and unique-name suffix matches on receivers#1128
fix(registry): restrict same-module and unique-name suffix matches on receivers#1128sahil-mangla wants to merge 3 commits into
Conversation
|
Thanks for taking on the receiver false-positive problem. The exact head is security-clean and DCO passes, but it is not correct enough to merge:
The precision goal is valid, but the registry currently lacks enough receiver/language/type evidence for this global heuristic: it is simultaneously too strict for valid Java dispatch and too permissive for unrelated Method candidates. Please redesign the suppression around receiver-aware evidence, preserve the Java enum convergence test, and update the PR's “full suite clean” statement after the complete matrix is actually green. |
25457d2 to
7c78413
Compare
7c78413 to
0b22112
Compare
…ce receivers Signed-off-by: sahil-mangla <manglasahil2017@gmail.com>
…nit tests Signed-off-by: sahil-mangla <manglasahil2017@gmail.com>
Signed-off-by: sahil-mangla <manglasahil2017@gmail.com>
ab4e7e5 to
e6e5377
Compare
|
@DeusData the registry fix it ready to be reviewed! |
|
Thanks for the update. I see current head |
Description
This PR tightens the call-resolution core in the registry to prevent false-positive
CALLSedge resolutions when dealing with qualified receivers, improving precision across all supported languages.Changes
resolve_same_moduleon receivers: Theresolve_same_modulestrategy now validates the receiver prefix. It will correctly resolve self-receivers (self.get), exact module prefixes (proj.pkg.service.get), and last-segment namespace matches (service.get). It actively rejects resolving to local functions when the receiver is clearly unrelated (e.g.,axios.getor_get_store().get), preventing spurious edges to same-named functions within the current module.resolve_name_lookupfor qualified callees: Added aqn_ends_with_qualifiedcheck. If a callee name is explicitly qualified (e.g., contains.or::), the resolution candidate's qualified name must properly terminate with that exact qualification (unless the candidate is explicitly labeled as a Method), preventing cross-namespace leakage on generic method names.Impact
get,add,update) when invoked on unrelated imported or delegated receiver objects.resolve_same_module_only_on_self_receiverand verified the full test suite runs cleanly.