@oculum/scanner 1.0.14 → 1.0.15

package/src/__tests__/taint/cfg-builder.test.ts

@@ -0,0 +1,835 @@
+/**
+ * Unit tests for CFG construction
+ */
+
+import Parser from 'tree-sitter'
+import { createHash } from 'crypto'
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { typescript: TypeScript } = require('tree-sitter-typescript')
+import type { ParsedAST } from '../../parse/ast'
+import type { CFG, CFGEdge, CFGEdgeKind } from '../../taint/cfg-types'
+import {
+  buildCFG,
+  buildFileCFGs,
+  getSuccessors,
+  getPredecessors,
+  isReachable,
+} from '../../taint/cfg-builder'
+
+const tsParser = new Parser()
+tsParser.setLanguage(TypeScript)
+
+let counter = 0
+
+function makeParsedAST(code: string): ParsedAST {
+  const fp = `cfg-test-${++counter}.ts`
+  const tree = tsParser.parse(code)
+  const hash = createHash('sha1').update(code + counter).digest('hex')
+  return { tree, language: 'typescript', filePath: fp, hash }
+}
+
+/** Build a CFG for the first function found in the code. */
+function buildFirstFnCFG(code: string): CFG {
+  const ast = makeParsedAST(code)
+  const cfgs = buildFileCFGs(ast)
+  // Return first non-module CFG, or the module one
+  for (const [name, cfg] of cfgs) {
+    if (name !== '<module>') return cfg
+  }
+  return cfgs.get('<module>')!
+}
+
+/** Get all edges of a specific kind from a node. */
+function edgesFrom(cfg: CFG, nodeId: number, kind?: CFGEdgeKind): CFGEdge[] {
+  const edges = cfg.edges.get(nodeId) ?? []
+  return kind ? edges.filter(e => e.kind === kind) : edges
+}
+
+/** Get node by label substring match. */
+function findNode(cfg: CFG, labelSubstr: string) {
+  for (const node of cfg.nodes.values()) {
+    if (node.label.includes(labelSubstr)) return node
+  }
+  return null
+}
+
+/** Count total edges in the CFG. */
+function edgeCount(cfg: CFG): number {
+  let count = 0
+  for (const edges of cfg.edges.values()) count += edges.length
+  return count
+}
+
+// ============================================================================
+// Sequential Flow
+// ============================================================================
+
+describe('CFG: sequential flow', () => {
+  it('empty function: entry → exit', () => {
+    const cfg = buildFirstFnCFG('function f() {}')
+    expect(cfg.nodes.size).toBe(2) // entry + exit
+    expect(getSuccessors(cfg, 0)).toEqual([1]) // entry → exit
+  })
+
+  it('single statement', () => {
+    const cfg = buildFirstFnCFG('function f() { const x = 1 }')
+    expect(cfg.nodes.size).toBe(3) // entry + stmt + exit
+    const succs = getSuccessors(cfg, 0)
+    expect(succs.length).toBe(1)
+    const stmtId = succs[0]
+    expect(getSuccessors(cfg, stmtId)).toEqual([1]) // stmt → exit
+  })
+
+  it('three sequential statements', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        const a = 1
+        const b = 2
+        const c = 3
+      }
+    `)
+    expect(cfg.nodes.size).toBe(5) // entry + 3 stmts + exit
+
+    // entry → s1 → s2 → s3 → exit
+    let current = 0
+    for (let i = 0; i < 3; i++) {
+      const succs = getSuccessors(cfg, current)
+      expect(succs.length).toBe(1)
+      current = succs[0]
+    }
+    expect(getSuccessors(cfg, current)).toEqual([1]) // last → exit
+  })
+
+  it('variable declaration produces defs', () => {
+    const cfg = buildFirstFnCFG('function f() { const x = y + z }')
+    const stmtId = getSuccessors(cfg, 0)[0]
+    const node = cfg.nodes.get(stmtId)!
+    expect(node.defs.has('x')).toBe(true)
+    expect(node.uses.has('y')).toBe(true)
+    expect(node.uses.has('z')).toBe(true)
+  })
+})
+
+// ============================================================================
+// If / Else
+// ============================================================================
+
+describe('CFG: if/else', () => {
+  it('if without else: condition has true and false exits', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        if (x > 0) {
+          console.log('positive')
+        }
+        return x
+      }
+    `)
+
+    // entry → condition → (true) body → return → exit
+    //                   → (false) return → exit
+    const condId = getSuccessors(cfg, 0)[0]
+    const condNode = cfg.nodes.get(condId)!
+    expect(condNode.kind).toBe('condition')
+
+    const trueEdges = edgesFrom(cfg, condId, 'true')
+    const falseEdges = edgesFrom(cfg, condId, 'false')
+    expect(trueEdges.length).toBe(1)
+    expect(falseEdges.length).toBe(1)
+  })
+
+  it('if with else: both branches merge', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        if (x > 0) {
+          const a = 1
+        } else {
+          const b = 2
+        }
+        return x
+      }
+    `)
+
+    const condId = getSuccessors(cfg, 0)[0]
+    const trueTarget = edgesFrom(cfg, condId, 'true')[0].to
+    const falseTarget = edgesFrom(cfg, condId, 'false')[0].to
+
+    // Both branches should reach the return statement
+    const returnNode = findNode(cfg, 'return')!
+    expect(isReachable(cfg, trueTarget, returnNode.id)).toBe(true)
+    expect(isReachable(cfg, falseTarget, returnNode.id)).toBe(true)
+  })
+
+  it('else-if chain', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        if (x > 0) {
+          return 1
+        } else if (x < 0) {
+          return -1
+        } else {
+          return 0
+        }
+      }
+    `)
+
+    // Should have two condition nodes
+    let condCount = 0
+    for (const node of cfg.nodes.values()) {
+      if (node.kind === 'condition') condCount++
+    }
+    expect(condCount).toBe(2)
+
+    // All branches should reach exit
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('return in if: dead code after', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        if (x > 0) {
+          return 1
+        }
+        return 0
+      }
+    `)
+
+    // The first return connects to exit via 'return' edge
+    const returnNodes = [...cfg.nodes.values()].filter(
+      n => n.label.includes('return')
+    )
+    expect(returnNodes.length).toBe(2) // two returns
+    for (const rn of returnNodes) {
+      const edges = edgesFrom(cfg, rn.id, 'return')
+      expect(edges.length).toBe(1)
+      expect(edges[0].to).toBe(1) // exit
+    }
+  })
+
+  it('return in both branches: dead code after if', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: boolean) {
+        if (x) {
+          return 1
+        } else {
+          return 2
+        }
+        const dead = 'unreachable'
+      }
+    `)
+
+    // dead code node should not be created (pending exits empty → break)
+    const deadNode = findNode(cfg, 'unreachable')
+    expect(deadNode).toBeNull()
+  })
+
+  it('empty if body', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: boolean) {
+        if (x) {}
+        return 1
+      }
+    `)
+    // Should still have condition with true/false edges
+    const condId = getSuccessors(cfg, 0)[0]
+    expect(edgesFrom(cfg, condId, 'true').length).toBeGreaterThanOrEqual(1)
+    expect(edgesFrom(cfg, condId, 'false').length).toBe(1)
+  })
+})
+
+// ============================================================================
+// While
+// ============================================================================
+
+describe('CFG: while', () => {
+  it('basic while loop', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        let i = 0
+        while (i < 10) {
+          i++
+        }
+        return i
+      }
+    `)
+
+    // Find the condition node
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(condNode).toBeDefined()
+
+    // Condition has true and false edges
+    expect(edgesFrom(cfg, condNode.id, 'true').length).toBe(1)
+    expect(edgesFrom(cfg, condNode.id, 'false').length).toBe(1)
+
+    // Body should have back-edge to condition
+    const trueTarget = edgesFrom(cfg, condNode.id, 'true')[0].to
+    expect(isReachable(cfg, trueTarget, condNode.id)).toBe(true) // back-edge exists
+  })
+
+  it('while with break', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        while (true) {
+          if (check()) break
+          process()
+        }
+        return 'done'
+      }
+    `)
+
+    // break should create a 'break' edge
+    const breakNode = findNode(cfg, 'break')!
+    expect(breakNode).toBeDefined()
+
+    // The return statement should be reachable from entry
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('while with continue', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        let i = 0
+        while (i < 10) {
+          i++
+          if (i === 5) continue
+          process(i)
+        }
+      }
+    `)
+
+    // continue should have an edge back to condition
+    const continueNode = findNode(cfg, 'continue')!
+    expect(continueNode).toBeDefined()
+    const continueEdges = edgesFrom(cfg, continueNode.id, 'continue')
+    expect(continueEdges.length).toBe(1)
+    // Target should be the condition node
+    const target = cfg.nodes.get(continueEdges[0].to)!
+    expect(target.kind).toBe('condition')
+  })
+
+  it('while(true) has no false exit', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        while (true) {
+          break
+        }
+      }
+    `)
+
+    // The condition node should still have a false edge (always present for while)
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    // false edge exists but in while(true) it's a syntactic artifact
+    // Important: the break provides the actual exit
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+})
+
+// ============================================================================
+// For
+// ============================================================================
+
+describe('CFG: for', () => {
+  it('basic for loop', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        for (let i = 0; i < 10; i++) {
+          process(i)
+        }
+      }
+    `)
+
+    // Should have: init node, condition node, update node, body node
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(condNode).toBeDefined()
+    expect(isReachable(cfg, 0, condNode.id)).toBe(true)
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('for with break', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        for (let i = 0; i < 10; i++) {
+          if (i === 5) break
+          process(i)
+        }
+        return 'done'
+      }
+    `)
+
+    const breakNode = findNode(cfg, 'break')!
+    expect(breakNode).toBeDefined()
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('for continue targets update (not condition)', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        for (let i = 0; i < 10; i++) {
+          if (i === 5) continue
+          process(i)
+        }
+      }
+    `)
+
+    const continueNode = findNode(cfg, 'continue')!
+    const continueEdges = edgesFrom(cfg, continueNode.id, 'continue')
+    expect(continueEdges.length).toBe(1)
+
+    // The continue target should be the update node (i++), not the condition
+    const target = cfg.nodes.get(continueEdges[0].to)!
+    expect(target.kind).toBe('statement') // update is a statement
+  })
+
+  it('for(;;) infinite loop — only break exits', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        for (;;) {
+          if (done()) break
+        }
+        return 1
+      }
+    `)
+
+    // Should be reachable from entry to exit (via break)
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+})
+
+// ============================================================================
+// For-of / For-in
+// ============================================================================
+
+describe('CFG: for-of / for-in', () => {
+  it('basic for-of', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(items: string[]) {
+        for (const item of items) {
+          process(item)
+        }
+      }
+    `)
+
+    const headerNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(headerNode).toBeDefined()
+    expect(headerNode.defs.has('item')).toBe(true)
+    expect(headerNode.uses.has('items')).toBe(true)
+  })
+
+  it('for-in', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(obj: Record<string, number>) {
+        for (const key in obj) {
+          console.log(key)
+        }
+      }
+    `)
+
+    const headerNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(headerNode).toBeDefined()
+    expect(headerNode.defs.has('key')).toBe(true)
+  })
+
+  it('destructuring in for-of header', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(entries: [string, number][]) {
+        for (const [key, value] of entries) {
+          use(key, value)
+        }
+      }
+    `)
+
+    const headerNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(headerNode.defs.has('key')).toBe(true)
+    expect(headerNode.defs.has('value')).toBe(true)
+  })
+})
+
+// ============================================================================
+// Do-while
+// ============================================================================
+
+describe('CFG: do-while', () => {
+  it('basic do-while', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        let i = 0
+        do {
+          i++
+        } while (i < 10)
+      }
+    `)
+
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(condNode).toBeDefined()
+
+    // The true edge should go back (to merge node before body)
+    const trueEdges = edgesFrom(cfg, condNode.id, 'true')
+    expect(trueEdges.length).toBe(1)
+
+    // false edge exits loop
+    const falseEdges = edgesFrom(cfg, condNode.id, 'false')
+    expect(falseEdges.length).toBe(1)
+  })
+
+  it('break inside do-while', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        do {
+          if (done()) break
+          work()
+        } while (true)
+        cleanup()
+      }
+    `)
+
+    const breakNode = findNode(cfg, 'break')!
+    expect(breakNode).toBeDefined()
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+})
+
+// ============================================================================
+// Try / Catch / Finally
+// ============================================================================
+
+describe('CFG: try/catch/finally', () => {
+  it('try/catch creates exception edge', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        try {
+          riskyOp()
+        } catch (e) {
+          handleError(e)
+        }
+      }
+    `)
+
+    const tryEntry = findNode(cfg, 'try-entry')!
+    expect(tryEntry).toBeDefined()
+
+    // Exception edge from try-entry to catch
+    const exceptionEdges = edgesFrom(cfg, tryEntry.id, 'exception')
+    expect(exceptionEdges.length).toBe(1)
+
+    const catchEntry = cfg.nodes.get(exceptionEdges[0].to)!
+    expect(catchEntry.label).toBe('catch-entry')
+  })
+
+  it('try/catch/finally merges both paths', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        try {
+          riskyOp()
+        } catch (e) {
+          handleError(e)
+        } finally {
+          cleanup()
+        }
+      }
+    `)
+
+    // finally node should be reachable from both try and catch paths
+    const cleanupNode = findNode(cfg, 'cleanup')!
+    expect(cleanupNode).toBeDefined()
+    expect(isReachable(cfg, 0, cleanupNode.id)).toBe(true)
+    expect(isReachable(cfg, cleanupNode.id, 1)).toBe(true) // finally → exit
+  })
+
+  it('catch parameter is a def', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        try {
+          throw new Error('fail')
+        } catch (err) {
+          console.log(err)
+        }
+      }
+    `)
+
+    const catchEntry = findNode(cfg, 'catch-entry')!
+    expect(catchEntry.defs.has('err')).toBe(true)
+  })
+
+  it('return inside try still has exception edge', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        try {
+          return getValue()
+        } catch (e) {
+          return fallback()
+        }
+      }
+    `)
+
+    const tryEntry = findNode(cfg, 'try-entry')!
+    const exceptionEdges = edgesFrom(cfg, tryEntry.id, 'exception')
+    expect(exceptionEdges.length).toBe(1)
+
+    // Both returns should reach exit
+    const returnNodes = [...cfg.nodes.values()].filter(n => n.label.includes('return'))
+    for (const rn of returnNodes) {
+      expect(edgesFrom(cfg, rn.id, 'return').some(e => e.to === 1)).toBe(true)
+    }
+  })
+})
+
+// ============================================================================
+// Switch
+// ============================================================================
+
+describe('CFG: switch', () => {
+  it('switch with break per case', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        switch (x) {
+          case 1:
+            console.log('one')
+            break
+          case 2:
+            console.log('two')
+            break
+        }
+      }
+    `)
+
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    expect(condNode).toBeDefined()
+
+    // Should have edges to both cases
+    const trueEdges = edgesFrom(cfg, condNode.id, 'true')
+    expect(trueEdges.length).toBe(2) // two cases
+
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('switch with fallthrough', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        switch (x) {
+          case 1:
+            setup()
+          case 2:
+            process()
+            break
+        }
+      }
+    `)
+
+    // Case 1 should have a fallthrough edge to case 2's body
+    // (or rather, case 2 should have a fallthrough entry from case 1's exits)
+    let hasFallthrough = false
+    for (const edges of cfg.edges.values()) {
+      for (const edge of edges) {
+        if (edge.kind === 'fallthrough') {
+          hasFallthrough = true
+          break
+        }
+      }
+      if (hasFallthrough) break
+    }
+    expect(hasFallthrough).toBe(true)
+  })
+
+  it('switch with default', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        switch (x) {
+          case 1:
+            return 'one'
+          default:
+            return 'other'
+        }
+      }
+    `)
+
+    // With a default case, there's no "no match" exit from the switch
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    const falseEdges = edgesFrom(cfg, condNode.id, 'false')
+    // No false edge because default catches everything
+    expect(falseEdges.length).toBe(0)
+  })
+
+  it('switch without default has false exit', () => {
+    const cfg = buildFirstFnCFG(`
+      function f(x: number) {
+        switch (x) {
+          case 1:
+            return 'one'
+        }
+        return 'none'
+      }
+    `)
+
+    // The switch condition should have a false exit for "no match"
+    const condNode = [...cfg.nodes.values()].find(n => n.kind === 'condition')!
+    const falseEdges = edgesFrom(cfg, condNode.id, 'false')
+    expect(falseEdges.length).toBe(1)
+  })
+})
+
+// ============================================================================
+// Return / Throw
+// ============================================================================
+
+describe('CFG: return/throw', () => {
+  it('return connects to exit with return edge', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        return 42
+      }
+    `)
+
+    const returnNode = findNode(cfg, 'return')!
+    const returnEdges = edgesFrom(cfg, returnNode.id, 'return')
+    expect(returnEdges.length).toBe(1)
+    expect(returnEdges[0].to).toBe(1) // exit
+  })
+
+  it('throw connects to exit when not in try', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        throw new Error('fail')
+      }
+    `)
+
+    const throwNode = findNode(cfg, 'throw')!
+    const throwEdges = edgesFrom(cfg, throwNode.id, 'throw')
+    expect(throwEdges.length).toBe(1)
+    expect(throwEdges[0].to).toBe(1) // exit
+  })
+
+  it('throw inside try connects to catch', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        try {
+          throw new Error('fail')
+        } catch (e) {
+          console.log(e)
+        }
+      }
+    `)
+
+    const throwNode = findNode(cfg, 'throw')!
+    const throwEdges = edgesFrom(cfg, throwNode.id, 'throw')
+    expect(throwEdges.length).toBe(1)
+    // Target should be the catch entry
+    const target = cfg.nodes.get(throwEdges[0].to)!
+    expect(target.label).toBe('catch-entry')
+  })
+})
+
+// ============================================================================
+// Labeled Statements
+// ============================================================================
+
+describe('CFG: labeled statements', () => {
+  it('break with label targets labeled loop', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        outer: while (true) {
+          while (true) {
+            break outer
+          }
+        }
+      }
+    `)
+
+    const breakNode = findNode(cfg, 'break')!
+    expect(breakNode).toBeDefined()
+    // The break should exit the OUTER loop, reaching exit
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('continue with label targets labeled loop', () => {
+    const cfg = buildFirstFnCFG(`
+      function f() {
+        outer: for (let i = 0; i < 10; i++) {
+          for (let j = 0; j < 10; j++) {
+            if (j === 5) continue outer
+          }
+        }
+      }
+    `)
+
+    const continueNode = findNode(cfg, 'continue')!
+    const continueEdges = edgesFrom(cfg, continueNode.id, 'continue')
+    expect(continueEdges.length).toBe(1)
+    // For a labeled for loop, continue should target the UPDATE node of the outer loop
+    const target = cfg.nodes.get(continueEdges[0].to)!
+    expect(target.kind).toBe('statement') // update is a statement node
+  })
+})
+
+// ============================================================================
+// buildFileCFGs
+// ============================================================================
+
+describe('buildFileCFGs', () => {
+  it('builds CFGs for multiple functions', () => {
+    const ast = makeParsedAST(`
+      function foo() { return 1 }
+      function bar() { return 2 }
+    `)
+    const cfgs = buildFileCFGs(ast)
+    expect(cfgs.has('foo')).toBe(true)
+    expect(cfgs.has('bar')).toBe(true)
+  })
+
+  it('builds module-level CFG for top-level code', () => {
+    const ast = makeParsedAST(`
+      const x = 1
+      console.log(x)
+    `)
+    const cfgs = buildFileCFGs(ast)
+    expect(cfgs.has('<module>')).toBe(true)
+    const moduleCfg = cfgs.get('<module>')!
+    expect(moduleCfg.nodes.size).toBeGreaterThan(2) // more than just entry+exit
+  })
+
+  it('function names match call-graph conventions', () => {
+    const ast = makeParsedAST(`
+      class MyClass {
+        myMethod() { return 1 }
+      }
+      const myArrow = () => 2
+      function myFunc() { return 3 }
+    `)
+    const cfgs = buildFileCFGs(ast)
+    expect(cfgs.has('MyClass.myMethod')).toBe(true)
+    expect(cfgs.has('myArrow')).toBe(true)
+    expect(cfgs.has('myFunc')).toBe(true)
+  })
+})
+
+// ============================================================================
+// Query Helpers
+// ============================================================================
+
+describe('CFG query helpers', () => {
+  it('getSuccessors returns correct successors', () => {
+    const cfg = buildFirstFnCFG('function f() { const x = 1; return x }')
+    const succs = getSuccessors(cfg, 0)
+    expect(succs.length).toBe(1)
+    expect(succs[0]).toBeGreaterThan(1) // not entry or exit
+  })
+
+  it('getPredecessors returns correct predecessors', () => {
+    const cfg = buildFirstFnCFG('function f() { return 1 }')
+    const preds = getPredecessors(cfg, 1) // predecessors of exit
+    expect(preds.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('isReachable: entry reaches exit', () => {
+    const cfg = buildFirstFnCFG('function f() { return 1 }')
+    expect(isReachable(cfg, 0, 1)).toBe(true)
+  })
+
+  it('isReachable: exit does not reach entry', () => {
+    const cfg = buildFirstFnCFG('function f() { return 1 }')
+    expect(isReachable(cfg, 1, 0)).toBe(false)
+  })
+
+  it('isReachable: same node returns true', () => {
+    const cfg = buildFirstFnCFG('function f() { return 1 }')
+    expect(isReachable(cfg, 0, 0)).toBe(true)
+  })
+})