CodeVetter · Repo Unpack · Risk map
koajs/koa
These risks describe source-level trust boundaries and coupling, not confirmed vulnerabilities. Proxy identity, cookie security, redirects, error exposure, and stream ownership deserve focused review when modified. Runtime file sources are supplied by consumer middleware in the inspected streaming examples; this investigation did not execute transports, dependencies, or publishing.
- Proxy mode trusts forwarded host/protocol/IP headers; maxIpsCount defaults to unlimited, and the request documentation explicitly describes forged X-Forwarded-For prefixes and configuration mitigations.
- Cookie secure behavior derives from request.secure, which in proxy mode derives from X-Forwarded-Proto; tests deliberately demonstrate this header-to-cookie trust path.
- back() checks URL.host equality, not scheme equality or a full origin; its test accepts an HTTPS referrer for a synthetic request whose default protocol is HTTP.
- Default error handling exposes err.message only through err.expose and clears outgoing headers before applying err.headers; already-sent responses can only emit the error event, not receive a replacement response.
- Stream ownership spans body assignment, on-finished destruction, replacement cleanup, and pipeline. When cleanupPreviousStream is reached, previous Node streams survive stream-to-stream replacement and are destroyed for non-stream replacements; the null-body branch with application/json type returns early before that cleanup.
- Importing application.js changes createHttpError.HttpError[Symbol.hasInstance] on the dependency constructor; the predicate requires an Error with expose and matching numeric status/statusCode.
- URL views intentionally differ: mutable path/query update req.url, while href and memoized URL use originalUrl; URL is not invalidated by the URL setter.
- ctx.respond=false bypasses the responder entirely, and the context documentation calls this unsupported because it can break Koa and middleware behavior.