# Risk map — jasmine/jasmine

> Canonical page: https://codevetter.com/unpack/jasmine/risk-map

# Risk map — jasmine/jasmine

Scanned commit 390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf (2026-08-19). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The principal runtime boundaries are arbitrary test callbacks, global mutation, asynchronous completion, reporter cloning, and URL parsing. Development tooling additionally invokes shells, writes outside the checkout, and integrates with credential-bearing browser infrastructure. The observations below are source findings or labeled hypotheses, not confirmed vulnerabilities; inspection did not establish exhaustive security or test coverage.
- NodeAdapter temporarily removes all process listeners for uncaughtException, unhandledRejection, and rejectionHandled, then restores saved listeners on uninstall; Env.execute calls cleanup after awaited execution without a surrounding finally. — [src/core/GlobalErrors.js#L218-L253](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/GlobalErrors.js#L218-L253) [src/core/Env.js#L413-L430](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/Env.js#L413-L430)
- Test functions execute directly in the host context via Function.call, and installGlobals assigns onto the chosen object; this execution boundary provides no callback isolation in the inspected path. — [src/core/QueueRunner.js#L187-L205](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/QueueRunner.js#L187-L205) [src/core/requireSuffix.js#L26-L31](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/requireSuffix.js#L26-L31)
- Malformed URI escapes or invalid path JSON may interrupt browser configuration/selection because QueryString.decodeURIComponent and HtmlSpecFilterV2.JSON.parse lack local recovery. This is a static failure hypothesis, not a reproduced defect. (inferred) — [src/html/QueryString.js#L54-L68](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/html/QueryString.js#L54-L68) [src/html/HtmlSpecFilterv2.js#L9-L17](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/html/HtmlSpecFilterv2.js#L9-L17) [src/boot/boot.js#L4-L13](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/boot/boot.js#L4-L13)
- Late async results can outlive their originating runnable: Env diagnoses late expectations, but routeLateFailure can only log when all results have already been reported; QueueRunner separately detects conflicting async styles and repeated done calls. — [src/core/Env.js#L215-L278](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/Env.js#L215-L278) [src/core/QueueRunner.js#L121-L153](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/QueueRunner.js#L121-L153) [src/core/QueueRunner.js#L262-L284](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/core/QueueRunner.js#L262-L284)
- The standalone template requests boot0.js, while the standalone archive's framework asset list includes jasmine.js, jasmine-html.js, jasmine.css, and boot.js but no boot0.js; this is a source-level packaging mismatch. — [src/SpecRunner.html.ejs#L10-L14](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/src/SpecRunner.html.ejs#L10-L14) [scripts/buildStandaloneDist.js#L39-L47](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/scripts/buildStandaloneDist.js#L39-L47)
- ci:performance passes jasmine-browser-performance.json, but ci.js always requires jasmine-browser.js and does not read process.argv; serve:performance uses a server script that does consume its filename argument. — [package.json#L23-L26](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/package.json#L23-L26) [spec/support/ci.js#L1-L9](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/support/ci.js#L1-L9) [spec/support/localJasmineBrowser.js#L5-L11](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/support/localJasmineBrowser.js#L5-L11)
- Package tests invoke npm pack and interpolated tar commands, load code from an OS temporary directory, and remove artifacts; standalone builds also create/remove temporary files. Running these checks exceeds a read-only source audit. — [spec/npmPackage/npmPackageSpec.js#L7-L24](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/npmPackage/npmPackageSpec.js#L7-L24) [spec/npmPackage/npmPackageSpec.js#L41-L44](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/npmPackage/npmPackageSpec.js#L41-L44) [spec/npmPackage/resetSpec.js#L17-L31](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/npmPackage/resetSpec.js#L17-L31) [scripts/buildStandaloneDist.js#L9-L14](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/scripts/buildStandaloneDist.js#L9-L14)
- Sauce configuration passes SAUCE_USERNAME and SAUCE_ACCESS_KEY to a remote grid, and CircleCI downloads/extracts a Sauce Connect executable before invoking tunnel scripts; the download stanza shows no checksum verification and the credential context excludes pull-request branches. — [spec/support/jasmine-browser.js#L34-L45](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/spec/support/jasmine-browser.js#L34-L45) [.circleci/config.yml#L129-L154](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/.circleci/config.yml#L129-L154) [.circleci/config.yml#L177-L184](https://github.com/jasmine/jasmine/blob/390d31e48106dd0d0b6dbcf5cf9071650fb2b4bf/.circleci/config.yml#L177-L184)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)