CodeVetter · Repo Unpack · Risk map
meteor/meteor
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include executable downloads, prototype permissions, authentication transport, network-facing DDP handlers, child processes, and generated filesystem output. The inspection also found a concrete limitation in two authorization test assertions.
- Source-checkout startup may download/extract a dependency kit and replace dev_bundle when missing or version-mismatched; this is an executable-download and filesystem-replacement boundary.
- create --prototype explicitly inserts autopublish and insecure; server mutations can then bypass collection validators, and automatic publications expose collection cursors unless prevented.
- The password handler accepts plaintext strings as well as SHA-256 digest objects and explicitly states that neither transport option is secure without SSL.
- DDP method and subscription rate-limit enforcement is conditional on the ddp-rate-limiter package being present; inspected transport handlers do not unconditionally apply that limiter.
- AppProcess spawns Node with computed environment, optional inspector settings, and an IPC pipe, then enables inter-process messaging; changes here affect process and diagnostic exposure boundaries.
- Project-local output can be redirected by METEOR_LOCAL_DIR, and build output uses the resolved user destination; building under the source tree only emits a warning because generated files may be interpreted as source.
- Hypothesis: changes to password hash configuration or asynchronous rehash scheduling could affect authentication compatibility because checkPasswordAsync supports both bcrypt-to-Argon2 migration and Argon2-to-bcrypt rollback after successful verification. (inferred)
- The inspected partial-allow and partial-deny tests assert 403 only inside catch blocks; a resolved update reaches the end without an explicit rejection assertion, limiting those two cases' ability to detect authorization regressions.