CodeVetter · Repo Unpack · Risk map
avajs/ava
The main security-sensitive boundaries are executable configuration, arbitrary test/setup imports, inherited worker environments, inspector access, IPC, and filesystem writes. These are source observations about a developer tool that executes project code, not confirmed vulnerabilities. Additional correctness concerns involve snapshot durability, dependency tracing limits, and an error-handling branch identified by inspection. No runtime reproduction or exhaustive security audit was performed.
- Configuration discovery imports ava.config.js/.mjs and invokes exported factories before test workers exist; automatic upward search means parent-directory configuration can execute in the CLI process.
- Both worker modes inherit process.env and apply configured overrides; worker isolation does not filter inherited environment values, and childProcess.fork launches Node with supplied execArgv.
- Setup modules and test paths execute via dynamic import or provider loaders; dependency setup resolution can write import-from-project.mjs under project node_modules even independently of provider cache selection.
- Debug mode accepts a configurable inspector host and port and calls inspector.open(..., true); the CLI default host is 127.0.0.1 and debugging is rejected in CI.
- Snapshot destinations incorporate source-map source paths or configured locations, while glob discovery follows symlinks; snapshot writes/deletions and temporary cache creation are filesystem boundaries that can extend beyond the checkout.
- Hypothesis: separate concurrent atomic writes for .snap and .md protect each file individually but can leave the pair inconsistent if one write fails; updating also deliberately discards snapshot decoding errors. (inferred)
- Hypothesis: a rejection from globs.findTests() leaves testFiles undefined, after which selectionInsights reads testFiles.length before the later reporting try/catch; this may bypass intended internal-error reporting. (inferred)
- Watch tracing intentionally ignores installed dependencies and non-exact file references, and config modules are not reloaded; observeRun's iterator additionally stops after the first run, with multi-run support marked TODO.