Allow JavaScript property named await in async functions

[anurag6569201]

CodeQL reported a JavaScript parse error for valid property access expressions named await inside async functions. This affected code such as:

const results = await pool.await();

• Parser

  • Keep contextual await/yield identifier restrictions for ordinary identifiers.
  • Allow liberal identifier parsing to accept reserved/contextual words when used as property names.

• Regression coverage

  • Add a focused QL extraction test for .await property access inside an async function.

• Fixes CodeQL confused by property named "await" in JavaScript code github/codeql#22499

DCA verifies that this change resolves somes spurious syntax errors.

Source merge-base: b5d570f106197f58168d1e57c952d065571fff17
Source head: 365727c445c8f0d60e078809a590c84279ac1e7e

[shipwright-agent]

✅ Shipwright · Approve

Recommendation: approve PR #9 · Tier T1
Checks: 0 total · 0 needing attention

Next step: ready to merge.

Findings (3)

• HIGH The test only asserts that some JSParseError exists (select err), but the expected file is empty. · javascript/ql/test/library-tests/AwaitPropertyName/AwaitPropertyName.ql:3
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• HIGH The change to parseIdent now suppresses the 'yield'/'await' identifier errors whenever liberal is true, not just for private fields. · javascript/extractor/src/com/semmle/jcorn/Parser.java:2299
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
• LOW (unverified) No direct security impact identified in this parser change, but relaxing keyword validation in a shared parser path could mask malformed input in security-sensitive analyses that r
  • Fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

Fireworks usage: 6,310 input · 365 output · 6,675 total tokens · $0.0016 · 8s · 0 fix iteration(s)

Open the Shipwright check for full evidence and the audit bundle. Use /shipwright rerun to verify again.

[shipwright-agent]

Shipwright · HIGH

The test only asserts that some JSParseError exists (select err), but the expected file is empty.

Impact: The test only asserts that some JSParseError exists (select err), but the expected file is empty. This means the test passes vacuously: it does not verify that the specific await/yield property-name cases parse without error, nor that unrelated parse errors are absent. A regression that makes the entire file fail to parse would still satisfy this query.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.

[shipwright-agent]

Shipwright · HIGH

The change to parseIdent now suppresses the 'yield'/'await' identifier errors whenever liberal is true, not just for private fields.

Impact: The change to parseIdent now suppresses the 'yield'/'await' identifier errors whenever liberal is true, not just for private fields. The liberal flag is used in contexts beyond property names (e.g., error recovery, certain parsing modes), so this could silently accept invalid generator/async code that previously raised recoverable errors, changing downstream AST/error behavior for existing queries.

Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.