# Risk map — pact-foundation/pact-js

> Canonical page: https://codevetter.com/unpack/pact-js/risk-map

# Risk map — pact-foundation/pact-js

Scanned commit 18f30a1aa44a948b3249a72879da3cff26c42d12 (2026-10-02). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These findings are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include temporary HTTP listeners, request logging, caller-selected filesystem paths, and plugin executables installed outside the checkout. Failure handling deserves particular attention because ordinary state errors, experimental mismatch filtering, and cleanup exceptions follow different paths.
- State-handler exceptions are logged and answered with HTTP 200, unlike hook exceptions accumulated for final rejection; stateHandler.spec.ts explicitly asserts this successful HTTP response after a rejected setup callback. — [src/dsl/verifier/proxy/stateHandler/stateHandler.ts#L26-L39](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/stateHandler/stateHandler.ts#L26-L39) [src/dsl/verifier/proxy/stateHandler/stateHandler.spec.ts#L45-L68](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/stateHandler/stateHandler.spec.ts#L45-L68) [src/dsl/verifier/verifier.ts#L113-L122](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/verifier.ts#L113-L122)
- Hypothesis: debug/trace output can expose sensitive test data because request/response tracers include bodies and headers and verifier trace logging serializes core options, which may contain broker authentication fields. (inferred) — [src/dsl/verifier/proxy/tracer.ts#L6-L36](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/tracer.ts#L6-L36) [src/dsl/verifier/proxy/tracer.ts#L73-L96](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/tracer.ts#L73-L96) [src/dsl/verifier/verifier.ts#L136-L149](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/verifier.ts#L136-L149) [docs/provider.md#L77-L80](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/docs/provider.md#L77-L80)
- Hypothesis: legacy MessageProviderPact may expose its callback dispatcher beyond loopback because setupProxyServer calls listen() without a host and registers a catch-all handler; the modern verifier explicitly defaults its bind host to 127.0.0.1. (inferred) — [src/messageProviderPact.ts#L30-L33](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/messageProviderPact.ts#L30-L33) [src/messageProviderPact.ts#L146-L158](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/messageProviderPact.ts#L146-L158) [src/dsl/verifier/proxy/proxy.ts#L87-L90](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/proxy.ts#L87-L90)
- Filesystem/process boundaries are caller-sensitive: binaryFile reads the supplied path without repo-root restriction, pact output uses opts.dir, and root pretest downloads a CLI into ~/.pact/bin then executes it to install MATT; the inspected downloader contains no checksum-validation step. — [src/v4/http/index.ts#L12-L37](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/index.ts#L12-L37) [package.json#L23-L24](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/package.json#L23-L24) [scripts/install-plugins.js#L35-L73](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/scripts/install-plugins.js#L35-L73) [scripts/install-plugins.js#L76-L98](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/scripts/install-plugins.js#L76-L98)
- Any nonempty PACT_EXPERIMENTAL_FEATURE_ALLOW_MISSING_REQUESTS value activates filtering that removes plugin mismatch objects and request-mismatch entries; HTTP execution rejects native failure only when filtered errors remain, so this flag materially changes validation. — [src/v3/display.ts#L91-L99](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v3/display.ts#L91-L99) [src/v4/http/index.ts#L71-L102](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/index.ts#L71-L102) [src/v3/pact.ts#L285-L316](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v3/pact.ts#L285-L316)
- Hypothesis: native mismatch inspection or pact-write exceptions can bypass remaining HTTP cleanup because these calls sit outside the callback try/catch and cleanup writes before stopping servers/plugins, without a finally guard. (inferred) — [src/v4/http/index.ts#L25-L37](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/index.ts#L25-L37) [src/v4/http/index.ts#L65-L102](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/index.ts#L65-L102) [src/v3/pact.ts#L279-L325](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v3/pact.ts#L279-L325)
- The public V4UnconfiguredInteraction interface advertises withCompleteRequest, but UnconfiguredInteraction.withCompleteRequest immediately throws an unimplemented error. — [src/v4/http/types.ts#L70-L92](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/types.ts#L70-L92) [src/v4/http/unconfiguredInteraction.ts#L82-L84](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/v4/http/unconfiguredInteraction.ts#L82-L84)
- Request.send creates an HTTPS agent with rejectUnauthorized=false and maxBodyLength=Infinity for caller-provided URLs; this differs from Verifier's default validateSSL=true, so the helper cannot be assumed to inherit verifier TLS behavior. — [src/common/request.ts#L41-L62](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/common/request.ts#L41-L62) [src/dsl/verifier/verifier.ts#L48-L50](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/verifier.ts#L48-L50) [src/dsl/verifier/proxy/proxyRequest.ts#L31-L36](https://github.com/pact-foundation/pact-js/blob/18f30a1aa44a948b3249a72879da3cff26c42d12/src/dsl/verifier/proxy/proxyRequest.ts#L31-L36)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)