tier synthesis: fetch to a third-party absolute URL links to the project's own route with the same path

Open Beginner friendly
  • Is something wrong?
#2,974 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
express, node.js, typescript
Domain
tooling

Research direction

Start at src/resolution/tier-synthesizer.ts around L473-L474, where an absolute URL's host is discarded and only its path is kept for matching. Read the surrounding cross-tier fetch-to-route matching logic and the existing tests for synthesized fetch edges before changing how clientPath is derived. Done means a third-party absolute URL such as https://api.github.com/users/x produces no project route edge, while URLs on the project's own baseURL, loopback, or served host still link; add or update a regression test for that case.

Written by the indexing model from the issue text.

Description

The cross-tier pass links a fetch to an absolute URL on another host to a route of the project's own server, because the URL's host is discarded before matching.

// package.json: { "dependencies": { "express": "^4.0.0" } }
// src/server.js
const app = require('express')()
function getUser (req, res) { res.json({}) }
app.get('/users/:id', getUser)

// src/client.js
async function loadGithubProfile (name) { return fetch(`https://api.github.com/users/${name}`) }
async function loadOwn (id) { return fetch(`/users/${id}`) }
edge on main (synthesized) expected
loadOwn → GET /users/:id ✓ same
loadGithubProfile → GET /users/:id ✗ none (GitHub's API, not this server)

Cause. tier-synthesizer.ts#L473-L474: clientPath keeps only the path of an absolute URL (if (absolute) p = absolute[1] ?? '/'), so https://api.github.com/users/x matches like /users/x.

Reproduced on main at 77ee3484 with CODEGRAPH_KERNEL=0. Linux/WSL2, Node 22.23.2.

Expected. An absolute URL with a literal host links to a project route only when that host is the project's own: the configured baseURL, localhost/loopback, or a host the project itself serves. Third-party APIs (api.github.com, api.stripe.com, …) share common REST paths like /users/:id, so every call to them currently lands on the project's handler.

Edited 2026-11-04: re-checked on main at f72c9d2e (with CODEGRAPH_KERNEL=0 and with the native kernel, Node 22.22.2): still reproduces. Added: a baseURL that is itself a third-party host (axios.create({ baseURL: 'https://api.github.com' })) links to the project's own route too, so a baseURL should count as own-host only when it is the project's. Nothing else changed.

Dominant language
C
Stars
73.2k
Forks
4.7k
Avg merge
3h 46m
Merged PRs (30d)
510

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from colbymchenry/codegraph

All issues in colbymchenry/codegraph

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.