pentest/electron_surface.py:33-35 scans raw source with re.M and has no notion of comments, so a declaration on its own line inside a /* … */ block matches:
/*
export const GET_CONFIG = 'old-channel-name';
*/
export const GET_CONFIG = 'get-configuration';
Two distinct values for GET_CONFIG are collected, _constant_map correctly refuses to guess between them, and the name is dropped from the map entirely. Every ipcMain.handle(GET_CONFIG, …) then resolves to nothing and the channel disappears from the surface — a real, live channel erased by a commented-out line.
Note the direction: the phantom entry does not produce a wrong channel, it produces a manufactured collision that removes a right one. A stale commented-out constant next to its replacement is exactly the shape a rename leaves behind, so this is reachable by ordinary maintenance rather than by anything unusual.
Same class as the comment-awareness gap already noted for webPreferences in #29.
Suggested fix: strip /* … */ and // runs before the constant pre-pass, or require the match to be outside a comment region computed once per file. Deliberately deferred out of the constant-channels branch.
pentest/electron_surface.py:33-35scans raw source withre.Mand has no notion of comments, so a declaration on its own line inside a/* … */block matches:Two distinct values for
GET_CONFIGare collected,_constant_mapcorrectly refuses to guess between them, and the name is dropped from the map entirely. EveryipcMain.handle(GET_CONFIG, …)then resolves to nothing and the channel disappears from the surface — a real, live channel erased by a commented-out line.Note the direction: the phantom entry does not produce a wrong channel, it produces a manufactured collision that removes a right one. A stale commented-out constant next to its replacement is exactly the shape a rename leaves behind, so this is reachable by ordinary maintenance rather than by anything unusual.
Same class as the comment-awareness gap already noted for
webPreferencesin #29.Suggested fix: strip
/* … */and//runs before the constant pre-pass, or require the match to be outside a comment region computed once per file. Deliberately deferred out of the constant-channels branch.