CodeVetter · Repo Unpack · Risk map
elysiajs/elysia
The main sensitive boundaries are generated code, cookie signatures, validation output, filesystem reads and WebSocket validation. Native static routing introduces a separate execution boundary that existing guards and regressions explicitly protect. Several implementation differences merit targeted investigation across runtimes and AOT modes. These are source observations or labeled hypotheses, not confirmed vulnerabilities.
- AOT executes generated JavaScript through Function, and compilation failures log generated instructions, hook source and definitions before potentially exiting the process; this is a broad failure and diagnostic boundary.
- Hypothesis: compilation diagnostics could expose cookie signing material because encodeCookie embeds the configured secret in generated code and the failure logger prints fnLiteral; no failure was induced. (inferred)
- Cookie verification uses crypto.timingSafeEqual when available but falls back to string equality otherwise; HMAC generation uses Web Crypto SHA-256 and Buffer-based base64 encoding.
- file(path) passes the supplied path to Bun.file or Node createReadStream/stat without a root restriction in this constructor; applications exposing request-derived paths must establish their own boundary.
- Native promotion bypasses the composed request pipeline; isEmptyPipelineHook rejects substantive hooks/schemas, while start, stop, error and afterResponse are explicitly allowed exceptions.
- Multipart reconstruction has explicit dangerous-key checks in both generated and dynamic nested traversal; duplicated parser implementations make consistent handling of dotted and indexed keys a sensitive edit boundary.
- Hypothesis: asynchronous Standard Schema WebSocket validators may escape validation because message and response checks read .issues directly from validate(data), whereas HTTP validation awaits Validate; this was not reproduced. (inferred)
- Production Standard Schema validation messages still include found:value; separately, dynamic selected-cookie signing requires schema membership and truthy values, while the AOT selected-cookie branch lacks that membership condition.