GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — JS: Require binding identifier after await using by sam-robson · Pull Request #23040 · github/codeql

Conversation

@sam-robson

@sam-robson sam-robson commented Nov 6, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Check that await using (and using in for loop initializers) is followed by an identifier on the same line before parsing it as a declaration, so calls like await using(...) parse as expressions.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sam-robson
sam-robson force-pushed the sam-robson/js-await-using-call branch from 681ab26 to 0f912db Compare November 6, 2026 10:05
@github-actions github-actions Bot added the JS label Nov 6, 2026
@sam-robson
fix(js): require identifier after await using declaration
d4eb971
@sam-robson
sam-robson force-pushed the sam-robson/js-await-using-call branch from 0f912db to d4eb971 Compare November 6, 2026 10:28
@sam-robson
sam-robson marked this pull request as ready for review November 6, 2026 11:53
@sam-robson
sam-robson requested review from a team as code owners November 6, 2026 11:53
Copilot AI auto review requested due to automatic review settings November 6, 2026 11:53
Copilot started reviewing on behalf of sam-robson November 6, 2026 11:54
View session
Copilot AI reviewed Nov 6, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The new using lookahead mishandles escaped and astral identifiers, valid JavaScript whitespace, and embedded line terminators, causing declarations to be incorrectly accepted or rejected.

3 open issues
  • Medium severity Lookahead misses JavaScript whitespace outside ASCII \s · New
  • Medium severity Line-break detection misses breaks within skipped whitespace · New
  • Medium severity Lookahead rejects escaped and astral binding identifiers · New
What changed in this PR

This PR updates the JavaScript extractor to distinguish resource declarations from expressions such as await using(...) by checking for a following binding identifier on the same line.

Changes:

  • Reuses declaration lookahead for await using and using in loop initializers.
  • Adds an awaited-call regression fixture and updates its expected AST.
File Description
javascript/​ql/​test/​library-tests/​AST/​ExplicitResource/​tst.js Adds an await using("foo") expression case.
javascript/​ql/​test/​library-tests/​AST/​ExplicitResource/​printAst.expected Records the expected awaited-call AST.
javascript/​extractor/​src/​com/​semmle/​jcorn/​Parser.java Shares binding lookahead across await and loop declaration checks.

Review effort: Balanced (auto)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread javascript/extractor/src/com/semmle/jcorn/Parser.java
Comment on lines 2635 to +2636
Matcher m = Whitespace.skipWhiteSpace.matcher(this.input);
m.find(this.pos);
m.find(pos);
Comment thread javascript/extractor/src/com/semmle/jcorn/Parser.java
int next = m.end();
return this.input.length() > next &&
!Whitespace.lineBreakG.matcher(inputSubstring(this.pos, next)).matches()
!Whitespace.lineBreakG.matcher(inputSubstring(pos, next)).matches()
Comment thread javascript/extractor/src/com/semmle/jcorn/Parser.java
return this.input.length() > next &&
!Whitespace.lineBreakG.matcher(inputSubstring(this.pos, next)).matches()
!Whitespace.lineBreakG.matcher(inputSubstring(pos, next)).matches()
&& Identifiers.isIdentifierChar(this.input.codePointAt(next), false);
asgerf
asgerf approved these changes Nov 11, 2026
View reviewed changes

@asgerf asgerf left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

The comments from CCR are technically valid concerns but it's better fixed by refactoring the parsing strategy for await using which is a larger change out of scope for this PR.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sam-robson
sam-robson merged commit 2d23b7f into main Nov 11, 2026
18 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@sam-robson
sam-robson deleted the sam-robson/js-await-using-call branch November 11, 2026 10:16
@sam-robson sam-robson mentioned this pull request Nov 11, 2026
JavaScript parser treats awaited using(...) call as await-using declaration #23036
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@asgerf asgerf asgerf approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

JS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@sam-robson @asgerf
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.