CodeVetter · Repo Unpack · Risk map
unjs/ofetch
The main review hotspots are URL rewriting, retry replay, abort composition, and error exposure. Several observable boundaries bypass normalized FetchError handling. Documentation also contains compatibility descriptions that differ from this alpha implementation. The following are source observations or explicitly marked hypotheses, not confirmed vulnerabilities.
- FetchError messages include the full request URL, and getters expose request/options/response; logging these objects can expose sensitive query or header data supplied by callers. (inferred)
- withBase uses a string prefix check and slash joining rather than origin-aware URL resolution; withQuery splits only at '?', with no explicit fragment handling.
- Explicit numeric retries can replay payload methods and reuse transformed bodies; consumed streams and non-idempotent operations therefore need targeted replay validation. (inferred)
- Retries retain context.options.signal, then compose another timeout signal; AbortError retry suppression is disabled whenever a timeout option is present.
- Serialization, timeout construction, JSON parsing, and most hooks lie outside the fetch try/catch, so their exceptions can bypass onRequestError and normalized retry/error handling.
- isJSONSerializable accesses value.buffer after checking typeof object; its earlier 't === null' condition cannot recognize null, although top-level falsy bodies skip the caller's payload branch.
- README names ufo for URL handling and describes response.ok-based failures, while current source uses local URL helpers and specifically rejects statuses 400–599.
- Network-sensitive examples include GH_TOKEN authentication and public gist creation; README demonstrates disabling TLS verification, and the release script publishes and pushes.