CodeVetter · Repo Unpack · Risk map
preactjs/preact
The security-sensitive runtime boundaries inspected are raw HTML assignment, DOM attributes/events, VNode identity checks, compiler serialization overrides, and the devtools attachment hook. Renderer correctness also depends on cross-package property mappings and careful coordination of suspension, hydration, portals, refs, and effects. Tests contain explicit skips, and workflow source exposes concrete wiring and artifact-handling concerns. These are source observations or labeled hypotheses, not confirmed vulnerabilities or reproduced runtime failures; no whole-repository absence of auth, IPC, secrets, or other integrations is claimed.
- dangerouslySetInnerHTML assigns newHtml.__html directly to dom.innerHTML without sanitization in this path; applications must control the supplied HTML trust boundary.
- setProperty writes DOM properties or attributes directly, including href through the attribute route; no URL-scheme validation appears in this function.
- The renderer rejects VNodes whose constructor is not undefined, and both factories establish that marker; changing the marker or coercion logic touches the documented JSON-injection defense.
- jsxAttr accepts a string returned by options.attr before default entity encoding, so custom serializers control a raw serialized-HTML output boundary.
- Devtools attachment invokes a global __PREACT_DEVTOOLS__.attachPreact with shared options and component primitives; that bridge assumes the installed global hook is trusted.
- Private properties shared by independently built bundles require stable mangle mappings; the build warns about newly mangled properties lacking cache entries, making mapping changes a cross-addon compatibility hotspot.
- Hooks, debug, compat normalization, and Suspense all replace callbacks on the same options object while retaining previous callbacks; integration behavior depends on preserving those chains.
- Hypothesis: suspension/hydration/portal edits have a broad correctness impact because marker rescanning, DOM cursors, alternate containers, retained hook state, and cleanup routing interact across core and addons. (inferred)
- Three inspected suspended-child update cases and a throwing-ref unmount case are skipped; this is an explicit regression-coverage gap, not proof of current failure.
- Compat transition APIs do not provide concurrent scheduling: startTransition calls immediately, useDeferredValue returns its input, useTransition reports false, and useInsertionEffect aliases useLayoutEffect.
- The manual single-benchmark workflow calls ci.yml as a reusable workflow with ref/artifact_name inputs, but ci.yml declares no workflow_call trigger; it also renames the local tarball before a subsequent rm -rf * step.
- People Browser consumes external Random User JSON without an explicit HTTP status check before parsing/model insertion; malformed responses or model incompatibility can interrupt this demo flow.
- The browser configuration selects Chromium only and contains an isolation-leak TODO; browser portability and global addon-state isolation therefore need validation beyond the inspected configuration. (inferred)
- The PR reporter crosses into authenticated GitHub API/comment operations and downloaded benchmark artifacts; release automation has contents-write and id-token-write jobs, making these CI integration boundaries sensitive to workflow edits.