CodeVetter · Repo Unpack · Risk map
sindresorhus/got
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Important boundaries include inherited credentials, redirect payload replay, diagnostic subscribers, local sockets, and caller-supplied transport settings. Async hooks and stream cleanup couple several request states, making seemingly small edits consequential. Buffering and a documented cache dependency limitation warrant targeted validation in a later execution-authorized task.
- Cross-origin 307/308 redirects intentionally preserve replayable bodies while removing inherited credentials; applications cannot equate credential stripping with preventing payload disclosure to a redirect destination.
- allowAbsoluteUrls:false restricts explicit inputs with prefixUrl, but internal redirects temporarily permit resolved absolute URLs; Unix sockets are separately opt-in and redirects cannot switch socket paths. These controls have distinct scopes.
- Diagnostic URLs have username/password removed, but request-start and response-start publications include full headers; subscribers therefore receive potentially sensitive Authorization, Cookie, or Set-Cookie values.
- Hypothesis: large or highly compressed responses can impose substantial memory pressure in Promise mode because _setRawBody() materializes chunks and concatenated bytes, while text/JSON paths can also retain decoded strings; strictContentLength validates transferred length rather than a decoded-size ceiling. (inferred)
- timeout.request starts only once initial setup is complete, so an initial beforeRequest hook can outlast that configured budget; a dedicated regression test explicitly expects a 1500ms hook to succeed with a 1000ms request timeout.
- Retry cleanup is tightly coupled to body identity: Request temporarily clears a replacement body during destroy(), preserves it for the next attempt, and asPromise rejects unchanged non-replayable bodies; incorrect ordering can destroy the replacement or reuse consumed input.
- HTTP/2 protocol/session identity includes certificate settings, rejectUnauthorized, checkServerIdentity, and lookup identity; removing these key components could defeat the separation that the checkServerIdentity regression test expects. (inferred)
- test/cache.ts explicitly attributes dropped newly introduced 304 metadata to http-cache-semantics and marks the scenario test.failing; this is a documented source-level limitation, not a failure reproduced during this inspection.