/** * Pass #83: blocking-main-thread (CWE-1050, category: performance) * * Detects synchronous/blocking operations inside HTTP request handlers * that stall the Node.js event loop, degrading latency under load. * * Scope: JavaScript / TypeScript only. * * Differentiation from SyncIoAsyncPass (#48): * SyncIoAsyncPass catches *Sync calls inside any `async` function. * This pass focuses specifically on request handler context * (NestJS/Express/Koa/Fastify/Hono) and includes expensive crypto/hashing * operations that are particularly harmful in synchronous handlers. * * Detection strategy: * 1. Identify request handler methods by: * a. HTTP method decorators in annotations (Get, Post, Put, Patch, Delete) * b. Common handler parameter names (req, res, ctx, c) * c. Conventional handler method names (handle, handler) * 2. Within those method ranges, scan graph.ir.calls for: * a. Blocking *Sync calls (readFileSync, execSync, spawnSync, etc.) * b. Synchronous crypto operations (createHash, hashSync, pbkdf2Sync, * scryptSync, generateKeyPairSync) * 3. Emit one warning per blocking call site. */ import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js'; export interface BlockingMainThreadResult { blockingInHandlers: Array<{ line: number; method: string; handler: string; reason: 'sync-suffix' | 'crypto'; }>; } export declare class BlockingMainThreadPass implements AnalysisPass { readonly name = "blocking-main-thread"; readonly category: "performance"; run(ctx: PassContext): BlockingMainThreadResult; private isRequestHandler; } //# sourceMappingURL=blocking-main-thread-pass.d.ts.map