CodeVetter · Repo Unpack · Risk map
gotestyourself/gotestsum
Security-sensitive boundaries are primarily local executable invocation and user-selected filesystem paths. Source observations identify report truncation, scanner limits, mutable reporting state, and differences between ordinary and watch execution. Release tooling also downloads external programs or scripts. These are source-level observations and explicitly labeled hypotheses, not confirmed vulnerabilities or runtime reproductions.
- Raw commands, hooks, and Delve execute user-selected or PATH-resolved programs with local process privileges; hooks inherit os.Environ, and commandValue uses shlex.Split without automatically invoking a shell.
- JSON, timing, JUnit, and rerun-report paths are passed to os.Create, which truncates existing files; the inspected writers do not constrain destinations to the repository root.
- --skip-stmt rewrites package-loader source paths directly with os.Create, promotes slow subtests to root functions, and does not add imports; earlier file writes can precede a final missing-test error.
- Both stream readers use bufio.NewScanner without increasing its token buffer; sufficiently large event or diagnostic lines can therefore terminate scanning with the wrapped scanner error.
- JUnit HideSkippedTests mutates each Execution-owned Package by decrementing Total and clearing Skipped; because the hook runs afterward, its TESTS_TOTAL and TESTS_SKIPPED can reflect filtered state rather than the summary printed earlier.
- Hypothesis: handler initialization errors deserve process/resource-cleanup review because run starts the child before creating the handler, returns before Wait on initialization failure, and defers handler.Close only after successful creation. (inferred)
- Watch runSingle explicitly lacks rerun-fails support and omits IgnoreNonJSONOutputLines and the ordinary signal-derived exit-code branch; Unix Watch tests exclude Windows, whose terminal adapter disables shortcuts.
- CircleCI verifies the downloaded GoReleaser archive checksum but pipes a remote lint installer into sh; the development Dockerfile also uses a remote installer and defaults to Go 1.18 despite go.mod requiring 1.24.0.