fix(js-x-ray): match quoted property keys in findPropertyMatch

[HoyeongJeon]

findPropertyMatch requires !prop.computed && isIdentifier(prop.key), so a property key written as a string literal is skipped even though its name is statically known.

crypto.scrypt(password, salt, 64, {  cost : 1024 }, cb)   // reported
crypto.scrypt(password, salt, 64, { "cost": 1024 }, cb)   // not reported

Both build the same object at runtime, and cost: 1024 is well below the lowest OWASP row, so the second one was a miss.

The key name is now resolved through a small getPropertyName helper:

key	resolved
{ cost: 1 }	"cost"
{ "cost": 1 }	"cost"
{ ["cost"]: 1 }	"cost"
{ [cost]: 1 }	null

The last row stays excluded. The real key is the value of cost at runtime, so it is not statically known. The existing test covering it still passes.

isWeakScrypt is the only probe using the helper today, so it is the only behaviour change. Added a regression test there, plus three cases on the helper itself.

Split out of #699 as suggested on Discord, so it can land independently.

[changeset-bot]

🦋 Changeset detected

Latest commit: 8292236

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@nodesecure/js-x-ray	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR