CodeVetter · Repo Unpack · Risk map
chaijs/chai
The principal observed boundaries are execution of consumer callbacks and getters, shared prototype/configuration mutation, and assertion-error disclosure. Plugins operate with the consumer process's capabilities. Source inspection also identifies recursive subset matching and exception-sensitive flag restoration as areas for targeted investigation. These are observations or explicitly labeled hypotheses, not confirmed vulnerabilities or runtime failures.
- should intentionally modifies Object.prototype, while registration modules assign globalThis properties; these operations affect the embedding realm beyond a single assertion.
- use directly invokes plugins with shared constructors, utilities, and config; no sandbox or rollback surrounds installation, and the plugin is recorded only after it returns.
- throw, change, satisfy, and subset field validators execute supplied functions synchronously; change retains callback side effects rather than restoring the subject.
- Type detection reads Symbol.toStringTag, property checks read obj[name], and subset comparison reads actual[key]; consumer getters or proxy traps can therefore execute during these reads.
- Failure output includes actual and expected references plus rendered values; truncateThreshold limits display text, but AssertionError metadata still receives the original values.
- Hypothesis: distinct cyclic expected/actual graphs can exhaust recursion in compareSubset because recursive branches have no visited-pair tracking; the inspected circular tests use finite expected structures. (inferred)
- Hypothesis: reusing an Assertion after catching an exception from a deep-equality or overwritten-method call can retain lockSsfi=true, because restoration occurs after the call without finally. (inferred)
- Verification gaps are visible in configuration: default suites omit nested type-detect files, the Deno fixture imports ../index.ts absent from the tracked inventory, and Node CI's matrix does not directly exercise the advertised Node 18 floor.