CodeVetter · Repo Unpack · Risk map
jasmine/jasmine
The principal runtime boundaries are arbitrary test callbacks, global mutation, asynchronous completion, reporter cloning, and URL parsing. Development tooling additionally invokes shells, writes outside the checkout, and integrates with credential-bearing browser infrastructure. The observations below are source findings or labeled hypotheses, not confirmed vulnerabilities; inspection did not establish exhaustive security or test coverage.
- NodeAdapter temporarily removes all process listeners for uncaughtException, unhandledRejection, and rejectionHandled, then restores saved listeners on uninstall; Env.execute calls cleanup after awaited execution without a surrounding finally.
- Test functions execute directly in the host context via Function.call, and installGlobals assigns onto the chosen object; this execution boundary provides no callback isolation in the inspected path.
- Malformed URI escapes or invalid path JSON may interrupt browser configuration/selection because QueryString.decodeURIComponent and HtmlSpecFilterV2.JSON.parse lack local recovery. This is a static failure hypothesis, not a reproduced defect. (inferred)
- Late async results can outlive their originating runnable: Env diagnoses late expectations, but routeLateFailure can only log when all results have already been reported; QueueRunner separately detects conflicting async styles and repeated done calls.
- The standalone template requests boot0.js, while the standalone archive's framework asset list includes jasmine.js, jasmine-html.js, jasmine.css, and boot.js but no boot0.js; this is a source-level packaging mismatch.
- ci:performance passes jasmine-browser-performance.json, but ci.js always requires jasmine-browser.js and does not read process.argv; serve:performance uses a server script that does consume its filename argument.
- Package tests invoke npm pack and interpolated tar commands, load code from an OS temporary directory, and remove artifacts; standalone builds also create/remove temporary files. Running these checks exceeds a read-only source audit.
- Sauce configuration passes SAUCE_USERNAME and SAUCE_ACCESS_KEY to a remote grid, and CircleCI downloads/extracts a Sauce Connect executable before invoking tunnel scripts; the download stanza shows no checksum verification and the credential context excludes pull-request branches.