# Risk map — testing-library/dom-testing-library

> Canonical page: https://codevetter.com/unpack/dom-testing-library/risk-map

# Risk map — testing-library/dom-testing-library

Scanned commit 6049cc0bc7cf2201625c476c95fa6299d0e2fa8b (2026-09-13). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries center on diagnostics exposing DOM/source content, stack-derived file reads, and privileged release automation. Correctness hotspots include global configuration, generated query/type coupling, accessibility semantics, and timer transitions. The inspected library paths operate on consumer DOM objects; this bounded review does not establish whole-repository absence of authentication, IPC, shell, or network behavior.
- Node diagnostics read a filename parsed from the first non-node_modules stack frame without a repository-root restriction; logDOM can print that file's code frame. This is an observed filesystem/output boundary, not evidence of attacker control. — [src/get-user-code-frame.js#L20-L49](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/get-user-code-frame.js#L20-L49) [src/get-user-code-frame.js#L52-L64](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/get-user-code-frame.js#L52-L64) [src/pretty-dom.js#L96-L102](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/pretty-dom.js#L96-L102)
- The playground helper compresses raw innerHTML into a logged and returned external-site URL, while element errors serialize DOM content. Neither path shown provides redaction; the playground helper itself performs URL construction rather than a network request. — [src/screen.ts#L16-L46](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/screen.ts#L16-L46) [src/config.ts#L35-L47](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/config.ts#L35-L47) [src/pretty-dom.js#L80-L93](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/pretty-dom.js#L80-L93)
- Role and label helpers interpolate role strings, aria-labelledby IDs, and for attributes into CSS selectors without escaping in the shown expressions; unusual quotes or selector characters are a correctness hypothesis requiring reproduction. (inferred) — [src/queries/role.ts#L307-L321](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/queries/role.ts#L307-L321) [src/label-helpers.ts#L62-L71](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/label-helpers.ts#L62-L71) [src/queries/label-text.ts#L167-L177](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/queries/label-text.ts#L167-L177)
- The role state filter returns at the first supplied selected/busy/checked/pressed/current/expanded/level condition; callers combining such options do not get conjunction across those conditions. ARIA value fields are combined only if execution reaches the value branch. — [src/queries/role.ts#L214-L264](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/queries/role.ts#L214-L264)
- Configuration is shared module state and getConfig returns it directly; the expensive-diagnostics helper restores its flag to false rather than its prior value. Nested invocation and test isolation therefore merit targeted verification. (inferred) — [src/config.ts#L53-L79](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/config.ts#L53-L79) [src/__tests__/config.js#L4-L20](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/__tests__/config.js#L4-L20)
- Source buildQueries explicitly notes a deviation from published variadic declarations; makeFindQuery forwards only matcher and options to its getter. Custom-query argument changes can affect runtime and public type compatibility simultaneously. — [src/query-helpers.ts#L120-L138](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/query-helpers.ts#L120-L138) [src/query-helpers.ts#L209-L222](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/query-helpers.ts#L209-L222) [types/query-helpers.d.ts#L70-L74](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/types/query-helpers.d.ts#L70-L74)
- Timer-switch branches reject directly rather than calling onDone, while normal cleanup is centralized in onDone; this is a lifecycle-review hotspot despite existing rejection-message tests, and cleanup consequences were not executed or confirmed. — [src/wait-for.js#L60-L67](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/wait-for.js#L60-L67) [src/wait-for.js#L108-L133](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/wait-for.js#L108-L133) [src/__tests__/wait-for.js#L235-L267](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/__tests__/wait-for.js#L235-L267)
- Release automation has OIDC/content/issue write permissions and installs without a lockfile; correctness also retains documented limitations: partial accessibility exclusion semantics, an ignored legacy constructor fallback, and a regression test recording mismatched query/error ignore behavior. — [.github/workflows/validate.yml#L63-L95](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/.github/workflows/validate.yml#L63-L95) [src/role-helpers.js#L32-L38](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/role-helpers.js#L32-L38) [src/events.js#L52-L63](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/events.js#L52-L63) [src/__tests__/element-queries.js#L1291-L1319](https://github.com/testing-library/dom-testing-library/blob/6049cc0bc7cf2201625c476c95fa6299d0e2fa8b/src/__tests__/element-queries.js#L1291-L1319)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)