CodeVetter · Repo Unpack · Risk map
honojs/hono
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Authentication, outbound fetch, file access, body consumption and response caching are sensitive boundaries. Shared routing state and duplicated adapter generations increase compatibility concerns. Partial test inspection cannot establish that any critical flow is wholly untested.
- Routing registration becomes immutable after SmartRouter's first match, and basePath clones share its router and route list; adding routes after serving begins can throw across related instances.
- Single-handler dispatch bypasses compose, whereas multi-handler dispatch enforces Context finalization; changes to return/error semantics must account for both paths.
- bodyLimit trusts Content-Length when Transfer-Encoding is absent; otherwise it consumes and buffers chunks before invoking downstream handlers.
- Hypothesis: callers constructing Requests with inconsistent Content-Length could defeat an actual-byte limit on the trusted-length branch; whether a deployment permits this depends on its ingress runtime. (inferred)
- CSRF protection applies to unsafe methods with form-compatible media types and allows the request if either Origin or Sec-Fetch-Site validation succeeds; it is not a universal check on every request type.
- JWT middleware requires a configured algorithm and secret, accepts bearer headers or configured cookies, and places verified claims in jwtPayload; JWKS verification rejects symmetric algorithms and checks the allowlist and matching key algorithm.
- JWKS verification performs fetch(options.jwks_uri, init), and JWK middleware can derive that URI from Context; outbound destination trust and fetch policy therefore belong to application configuration.
- Cache bypasses Authorization requests and responses with Set-Cookie, private/no-cache/no-store or unsupported Vary; its default background write accesses executionCtx, which throws if absent.
- Static serving rejects routed percent signs by default and suspicious decoded path segments, but configured path and rewriteRequestPath feed runtime file access; these callbacks/options are sensitive trust boundaries.
- SSG enforces lexical output containment before filesystem writes; the inspected filesystem interface has no realpath or symlink-resolution operation, so physical containment is not established by this check.
- SSG invokes application handlers for metadata and generated content, while createdDirs is module-global; generation lifecycle and handler side effects need attention when reusing an application or changing output directories.
- proxy() forwards through supplied fetch or global fetch and can carry raw request credentials; strictConnectionProcessing optionally removes headers named by an inbound Connection header and validates their syntax.
- The html template helper escapes ordinary string interpolation but accepts already-escaped values and exports raw; direct Context.html(string) also treats its input as HTML.
- Build declaration tests shell out to tsc and write temporary files outside the repository; build/release workflows also perform publication, so executing tooling exceeds this read-only investigation.
- The Bun adapter exists both as a separate package and as deprecated in-package exports scheduled for removal in v5, creating a compatibility maintenance boundary.