CodeVetter · Repo Unpack · Risk map
jestjs/jest
The following risks are source observations and maintenance limits, not confirmed vulnerabilities. Jest deliberately executes project code and extensibility modules, so configuration and snapshot inputs carry executable authority. Filesystem outputs and worker execution cross the repository-root boundary. Source comments and tests expose specific cache, validation, and ownership limitations without establishing their frequency in practice.
- getSnapshotData executes snapshot contents with new Function('exports', snapshotContents) before header validation and swallows evaluation errors; snapshot files must therefore be treated as executable trusted project inputs.
- Configuration files can execute modules or async exported functions, and orchestration loads custom filter/reporting modules; these paths run before or outside individual test bodies.
- --clearCache recursively removes configured cache directories, outputFile resolves against cwd and is written directly, and inline snapshots rewrite paths derived from captured stack frames; these operations are not confined by a repository-root check in the inspected functions.
- The VM environment is not a complete security boundary: CjsLoader routes core modules through CoreModuleProvider and loads .node files with native require, while runTest wraps process.exit for diagnostics and still calls the real exit.
- Changed-file detection launches Git subprocesses with project cwd and argument arrays; parallel runners cross process/thread boundaries with serialized configuration and module maps and can force workers to exit during cleanup.
- ScriptTransformer explicitly documents that independently cached code and source maps can become mismatched under concurrent writes; code checksums and atomic writes protect code artifacts but do not establish code/map pairing.
- Snapshot ownership has known compatibility limits: clear() without identity does not roll back file data or unchecked keys, and keys using ': ' cannot distinguish a hint from a longer test name, potentially retaining obsolete snapshots.
- Configuration normalization validates before preset merging, with a TODO stating preset-contributed options escape that validation; multiple projects without explicit --config also inherit global settings from the first project's configuration as a documented compatibility fallback.