CodeVetter · Repo Unpack · Risk map
effect-ts/effect
The inspected security-sensitive boundaries include credential handling, process execution, filesystem operations, native SQLite, dynamic compilation, and privileged CI. Several APIs intentionally expose caller-selected capabilities and therefore require appropriate consumer configuration. Two findings are explicitly labeled hypotheses requiring reproduction: concurrent schema-store modification and static-file symlink containment. None of these observations establishes a confirmed vulnerability or a repository-wide absence of safeguards.
- securityDecode extracts HTTP/API-key/Basic credentials and returns empty credentials for missing or malformed inputs; supplied security middleware determines acceptance. OpenAiClient separately reveals Redacted credentials to construct outbound headers and accepts a caller-selected apiUrl.
- NodeChildProcessSpawner forwards command and argument arrays to node:child_process.spawn after resolving cwd, environment, and stdio; buildSpawnOptions also forwards options.shell. This is a host process-execution boundary controlled by consumer command construction.
- Filesystem KeyValueStore rejects empty, dot, and dot-dot keys and percent-encodes filenames, but its clear operation recursively removes the entire supplied directory; the API documentation explicitly forbids sharing that directory with unrelated data.
- Node SQLite operations are synchronous and busy_timeout can block the event loop; the default is five seconds. The adapter also exposes caller-selected backup destinations and native extension loading, temporarily enabling extension support, while executeStream deliberately dies as unimplemented.
- Hypothesis: concurrent SchemaStore.modify calls can lose updates because modify performs get, an application transform, and set without a transaction or lock in this wrapper. Backend-specific or caller synchronization must be examined before treating it as atomic. (inferred)
- Hypothesis: static-file symlinks may escape the configured root because resolveFilePath enforces lexical normalized-path containment, then serving uses filesystem.stat on that path. Realpath containment is not established by the inspected functions; exploitability depends on filesystem behavior and writable tree contents. (inferred)
- Schema JIT uses globalThis.Function and a module-level compiler registry. Blocked dynamic construction or compilation failures retain interpretation, but previously captured parser entries are not replaced, making installation order an explicit behavioral constraint.
- Privileged CI deserves separate review: release-queue uses pull_request_target, checks out PRs after its fork environment gate, and grants write permissions; snapshot also gates forks. Bundle-comment consumes untrusted artifacts with symlink, size, line-count, and format validation before writing comments.