Skip to content

JavaScript externs model StorageEvent() with no type argument #22632

Description

@jmcerda

Description

javascript/externs/web/webstorage.js still models StorageEvent as a zero-argument constructor:

/**
 * @see http://www.w3.org/TR/2011/CR-webstorage-20111208/#the-storage-event
 * @extends {Event}
 * @constructor
 */
function StorageEvent() {}

Current HTML (the-storageevent-interface) defines:

constructor(DOMString type, optional StorageEventInit eventInitDict = {});

new StorageEvent('storage', { key, newValue, ... }) is valid in browsers (constructor available since 2018). CodeQL 2.27.0 reported a false positive on a standards-conforming new StorageEvent('storage', { ... }) call used in a synthetic StorageEvent test.

initStorageEvent in the same file also follows the old required-argument list; the spec method has optional arguments after type.

I searched this tracker for StorageEvent / StorageEventInit / webstorage externs and did not find an existing issue.

Reproduction

  1. Analyze JavaScript that constructs new StorageEvent('storage', { key: 'k', newValue: 'v' }).
  2. Observe a CodeQL alert that treats the constructor as taking no parameters.

Expected

Externs should match the current constructor (type plus optional StorageEventInit) so valid Web IDL usage is not flagged.

This is a modeling/false-positive report only. No exploit is claimed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions