/** * Pass #81: leaked-global (CWE-1109, category: reliability) * * Detects assignments to undeclared variables inside function bodies in * JavaScript/TypeScript. In non-strict mode JS (and absent `"use strict"`) * writing to a variable that has no `let`/`const`/`var` declaration anywhere * in the enclosing function silently creates (or mutates) a property on the * global object — a classic source of hard-to-trace bugs. * * Detection strategy: * 1. Language filter: JS/TS only. * 2. Build a ScopeGraph for declaration-keyword awareness. * 3. For each `kind='local'` def whose source line has NO declaration keyword: * - Skip intentional throwaway names (_, err, e, …) and loop vars. * - Skip if the variable IS declared (hasDeclKeyword=true) somewhere * else in the same enclosing function → it is a legitimate reassignment. * - Skip top-level assignments (methodStart === -1) — module-level bare * assignments are an ES module pattern. * - Flag the rest as potential global leaks. */ import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js'; export interface LeakedGlobalResult { leaks: Array<{ line: number; variable: string; /** Name of the enclosing function/method, or null if unavailable. */ enclosingFunction: string | null; }>; } export declare class LeakedGlobalPass implements AnalysisPass { readonly name = "leaked-global"; readonly category: "reliability"; run(ctx: PassContext): LeakedGlobalResult; } //# sourceMappingURL=leaked-global-pass.d.ts.map