CodeVetter · Repo Unpack · Risk map
mswjs/msw
These are source observations and explicitly marked hypotheses, not confirmed vulnerabilities. Network passthrough, persistent cookies, worker messaging, and serialized handler exceptions are the principal security-sensitive boundaries inspected. Shared lifecycle and streaming code has a broad behavioral impact, with regression tests documenting past failure modes. Documentation and automation also contain drift that should be verified before relying on their instructions.
- Default warn handling permits real HTTP traffic after warning; explicit bypass and passthrough also reach the network, while unmatched CONNECT bypasses regardless of the configured unhandled strategy.
- Browser mock cookies persist as JSON in origin localStorage and are also assigned to document.cookie; only persistence writes are caught for quota errors, while the initial localStorage.getItem call is outside that catch.
- ServiceWorkerHttpNetworkFrame.errorWith converts handler exceptions into HTTP 500 JSON containing name, message, and stack; Node's interceptor frame instead throws ordinary errors, creating an environment-specific error surface.
- WorkerChannel filters messages with a non-null source unequal to the selected worker, then accepts object payloads containing type; WebSocket managers process worker-stop window messages by type and remote BroadcastChannel commands by client id.
- The worker checksum is a normalized-source MD5 compatibility marker: mismatch produces a warning and resolves the integrity promise instead of blocking startup. It should not be interpreted as an authentication or tamper-enforcement mechanism.
- WebSocketHandler emits connection events synchronously, with an explicit FIXME about propagating asynchronous listener exceptions; the frame's try/catch surrounds that synchronous emission.
- CLI destinations accept absolute paths or resolve relative paths without repository containment, then create directories and overwrite the worker file; saving replaces the msw object with workerDirectory, so unrelated msw fields are not preserved by that assignment.
- Hypothesis: TypeScript-nightly may fail to exercise the intended RC check because compare writes step outputs without declaring job outputs, while test reads needs.compare.outputs and copies a version-specific config using a questionable shell interpolation. This needs workflow validation; no failure was observed. (inferred)