CodeVetter · Repo Unpack · Risk map
testing-library/dom-testing-library
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries center on diagnostics exposing DOM/source content, stack-derived file reads, and privileged release automation. Correctness hotspots include global configuration, generated query/type coupling, accessibility semantics, and timer transitions. The inspected library paths operate on consumer DOM objects; this bounded review does not establish whole-repository absence of authentication, IPC, shell, or network behavior.
- Node diagnostics read a filename parsed from the first non-node_modules stack frame without a repository-root restriction; logDOM can print that file's code frame. This is an observed filesystem/output boundary, not evidence of attacker control.
- The playground helper compresses raw innerHTML into a logged and returned external-site URL, while element errors serialize DOM content. Neither path shown provides redaction; the playground helper itself performs URL construction rather than a network request.
- Role and label helpers interpolate role strings, aria-labelledby IDs, and for attributes into CSS selectors without escaping in the shown expressions; unusual quotes or selector characters are a correctness hypothesis requiring reproduction. (inferred)
- The role state filter returns at the first supplied selected/busy/checked/pressed/current/expanded/level condition; callers combining such options do not get conjunction across those conditions. ARIA value fields are combined only if execution reaches the value branch.
- Configuration is shared module state and getConfig returns it directly; the expensive-diagnostics helper restores its flag to false rather than its prior value. Nested invocation and test isolation therefore merit targeted verification. (inferred)
- Source buildQueries explicitly notes a deviation from published variadic declarations; makeFindQuery forwards only matcher and options to its getter. Custom-query argument changes can affect runtime and public type compatibility simultaneously.
- Timer-switch branches reject directly rather than calling onDone, while normal cleanup is centralized in onDone; this is a lifecycle-review hotspot despite existing rejection-message tests, and cleanup consequences were not executed or confirmed.
- Release automation has OIDC/content/issue write permissions and installs without a lockfile; correctness also retains documented limitations: partial accessibility exclusion semantics, an ignored legacy constructor fallback, and a regression test recording mismatched query/error ignore behavior.