CodeVetter · Repo Unpack · Risk map
nestjs/nest
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Important boundaries include input transformation, application-provided authorization, browser-origin checks, cookie signing, file streaming, and tooling subprocesses. Several runtime paths are excluded from coverage measurement, and integration exclusions leave configured verification gaps. Framework-wide changes to injection or adapter semantics have a broad compatibility surface.
- Initialization errors abort the process by default; setting abortOnError:false selects rethrow behavior instead.
- The cats role guard depends on request.user supplied elsewhere; handlers without role metadata are allowed by this guard.
- Cross-origin protection deliberately permits GET, HEAD, OPTIONS, and requests without Origin or Sec-Fetch-Site; it is not a general authentication boundary.
- Route-based CSRF exclusions fail closed for noncanonical paths, while a configured exclusion predicate returns its own decision directly.
- CookieSigner validates nonempty signing secrets, uses HMAC-SHA256, verifies all rotation secrets, and compares equal-length signatures with timingSafeEqual.
- Hypothesis: different ValidationPipe instances supplying custom packages may interact because validator and transformer references are module-level variables reassigned by constructors. (inferred)
- The SQL sample enables synchronize:true; its startup therefore includes ORM-managed schema synchronization and warrants review before reuse with valuable data.
- StreamableFile's default pre-header error handler sends err.message in a 400 response; applications can replace that handler.
- Adapter compatibility includes direct Node response writes and net.Server assumptions, beyond the nominal abstract method interface.
- Docker tooling forwards CLI arguments into spawnSync and enables shell execution on Windows; this is an inspected contributor-tool subprocess boundary.
- The PR content guard uses pull_request_target with comment-write permission but reads changed content through APIs; it flags incomplete scans at GitHub's 3000-file limit.
- Coverage command failure suppression and excluded integration suites mean successful CI job completion alone cannot establish every inspected critical flow passed. (inferred)