matching keys and values in JavaScript objects

[ievans]

Reporting for an external user. When trying to match a structure like those found in package.json, such as:

{
  "name": "frontend",
  "version": "0.1.0",
  "private": true,
  "dependencies": {
    "@fortawesome/fontawesome-svg-core": "^1.2.32",
    "@fortawesome/free-regular-svg-icons": "^5.15.1",
  },
}

(1) The following matches only the first or last entry in the object:

{ ...,
  "dependencies": { 
    ...,
    $DEP_NAME: $DEP_VERSION,
    ...
  }
}

Desired behavior is that it returns a match for every key under "dependencies".

Playground url: https://semgrep.dev/s/2b25

Bonus bug, it finds nothing when in JSON mode. Playground url in JSON mode: https://semgrep.dev/s/XLXA

[aryx]

semgrep-core returns 22 matches, but the python wrapper reduces it to just one.

[aryx]

It's because the Python wrapper removes findings that have the same range, even if they have different metavariable bindings. Not sure
why we do that, but we have been doing that for a long time.

[aryx]

This might be a big change for the user @ievans because we may report multiple times the same findings, with the exact same range.

[emjin]

Relevant slack conversation: https://returntocorp.slack.com/archives/C01AX0QCEET/p1622757347088700

[aryx]

Note that the user should write the rule in a different way, where we match individual fields separately, with
a pattern-inside and pattern, but I just realized you could not write partial single field definition in a pattern
in JS (we could in JSON mode but not JS). This is partly because x: { stuff } is ambiguous and could also
be a statement (a label x followed by a block). But I think we can assume people prefer the partial field def so I've fixed that.

[aryx]

Ok the JSON part is fixed too: https://semgrep.dev/s/XLXA?version=develop

[aryx]

Also here is an alternative solution to the issue: use a pattern-inside and another pattern to just match the deps.
https://semgrep.dev/s/0npB/?version=develop

[aryx]

Works also in JS mode: https://semgrep.dev/s/KWGL/?version=develop

[aryx]

@ievans do you have a slack link to the request from the external user? That way I can tell him workarounds.