CodeVetter · Repo Unpack · Risk map
mochajs/mocha
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Mocha intentionally executes local configuration, plugins, and tests with process privileges. Sensitive boundaries include worker option evaluation, child-process environment inheritance, caller-selected output paths, and process-level exception handling. Browser support and documentation generation also have validation and external-service limits.
- Configuration discovery ascends from cwd, and JavaScript rc files execute through require; --require and custom reporter loading also execute resolved user modules. These paths require trusted local inputs.
- Parallel options are serialized with unsafe:true and ignoreFunction:true, then evaluated by worker run; worker creation copies process.env and adds MOCHA_WORKER_ID.
- init and reporter output use caller-selected paths without a repository-root confinement check in the inspected functions; init writes fixed filenames and JSON output overwrites its destination.
- The executable can spawn Node with inherited stdio, remap /dev/fd descriptors, and forward termination signals; worker completion removes all uncaughtException and unhandledRejection listeners in its process.
- Buffered parallel reporting can lose a crashing worker's earlier passing events before flush; an integration test explicitly expects that loss while checking attribution to the crashing spec file.
- Module loading branches on process.features.require_module and has error-specific require/import fallbacks; watch rebuilding manipulates the require cache and rebinds interfaces, making module-cache behavior a sensitive compatibility area.
- Hypothesis: the browser test server should remain a development-only service because it serves repository files, binds without an explicit host, and its containment check is lexical rather than a realpath/symlink check; no exploit was validated. (inferred)
- Docs generation fetches remote avatar URLs with a timeout and rejects HTML responses, while GraphQL pagination has no explicit timeout in the inspected request; production Netlify builds can fail the supporter-download success threshold.