CodeVetter · Repo Unpack · Risk map
adonisjs/core
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include network listeners, package installation and hooks, arbitrary replacement-file reads, generated-file writes, home-directory REPL history, cryptographic compatibility, and diagnostic HTML. Lifecycle and generated-artifact ordering create broad coupling between providers, services, and developer tooling. No exploit, production configuration, dependency implementation, or runtime outcome was verified.
- HTTP startup binds HOST or 0.0.0.0 and PORT or 3333 using Node createServer by default; a caller-supplied server factory is the local hook for HTTPS or other server customization.
- generate:key can write APP_KEY through EnvEditor or print it to logs; --force permits production writes and --show overrides force. This is a sensitive operator command, not an inspected secret file.
- Codemods.makeUsingStub intentionally accepts absolute contents-from paths and reads their UTF-8 contents; generation also supports forced replacement of destination files.
- add crosses a package-installation boundary through assembler CodeTransformer.installPackage and then executes imported package configure hooks with the command object. Shell/process details belong to the assembler dependency and were not established here.
- The REPL provider stores history at homedir()/.adonisjs_v6_repl_history and exposes module import and container construction helpers, making it a privileged local development surface outside the application root.
- Ignitor explicitly assumes one entrypoint creates the application per process; setApp overwrites shared module state and service facades resolve through that shared app's boot hook.
- configProvider.resolve checks only that an object has a type property before calling resolver; it does not locally check type==='provider' or resolver callability.
- Optional-import helpers swallow import errors, and Codemods.#getCodeTransformer also catches all initialization errors; broken packages can therefore reach the same missing-dependency path as unavailable packages.
- Route generation requires committed routes and correctly ordered generated indexes; development emitRoutes catches write failures and continues after logging, while standalone codegen depends on indexes existing before boot.
- Legacy encryption intentionally preserves v6 string-IV and ciphertext formatting, verifies HMAC before decryption, and rejects blind-index operations; edits have a compatibility blast radius documented by cross-version tests.
- Hypothesis requiring targeted verification: diagnostic HTML could be unsafe if callers supply untrusted titles, source metadata, editor templates, or CSP nonces, because these wrapper values are directly interpolated into HTML. The inspected tests use ordinary values and do not establish exploitability. (inferred)
- Hypothesis requiring a regression test: safeTiming may resolve after a callback throws null, false, 0, or an empty string because it rethrows only when caughtError is truthy; inspected error tests throw Error objects. (inferred)
- The route formatter's keyword-match branches return true independently of allowRoute, so supplying a keyword can bypass an earlier middleware-filter rejection in this local filtering function. This is an inspection-output behavior observation, not evidence of an authorization bypass.