CodeVetter · Repo Unpack · Risk map
QwikDev/qwik
The main sensitive boundaries are HTML/script generation, browser chunk loading, request routing and execution, scaffold filesystem writes, local inspection IPC, and privileged CI deployment. Concrete guards exist at several boundaries, including escaping, origin validation, byte limits, and loopback/token checks. Source inconsistencies and operational hypotheses below are not confirmed vulnerabilities. No runtime exploit, production configuration, credential value, or whole-repository absence was established.
- SSR escapes ordinary text and attribute values, while htmlNode writes raw HTML and dangerouslySetInnerHTML preserves supplied HTML; callers choosing raw output own a sensitive trust boundary.
- Backpatch scripts replace '<' with a Unicode escape and apply a supplied nonce; sync-function scripts also propagate serverData.nonce.
- Browser resolveHandler imports a URL derived from chunk metadata and q:base, then selects a named export; integrity of server-emitted QRL metadata is therefore a code-loading boundary.
- Router enables checkOrigin by default and prepends CSRF checks for mutation methods; the check compares origins for simple content types, with an explicit lax-proto mode.
- Server-function dispatch requires matching query hash/X-QRL and application/qwik-json, validates argument-array shape, and masks ordinary execution failures with an Invalid request response.
- Internal full-path headers must be relative absolute-path forms under the loader prefix; scheme-relative paths, foreign origins, and malformed URLs are rejected.
- limitRequestBody validates a positive safe integer and enforces a 10 MiB default by counting streamed bytes; Node middleware combines configured and caller-supplied limits using the smaller value.
- Loader result caching excludes redirect, error, and failed-result envelopes; developer-provided cache keys still define which successful serialized responses share cache entries.
- Scaffolding can clear an existing target directory under --force, write outside the repository into an absolute outDir, and invoke package-manager install through execa.
- MCP inspection guards its HTTP endpoint with loopback address, bearer token, absent Origin, exact Host, POST-only handling, and an 8192-byte request limit; discovery files use restrictive creation modes.
- Insights dashboard middleware requires a session email, but the inspected telemetry handler accepts a validated publicApiKey payload and permits auto-creation; schema validation is not itself proof of application ownership authorization.
- Insights sends its OK response before database operations finish, and counter-update comments explicitly accept missed-update risk from avoiding transactions.
- Hypothesis: first-insert delay histograms may use the wrong bucket because updateEdge increments delayBucketField(edge.latencyBucket), while existing-row updates use edge.delayBucket. This source inconsistency was not reproduced. (inferred)
- The root Dockerfile uses Node 16.12.0 and a network-fetched Rust installer, whereas the root manifest requires Node >=22.18.0; the CLI's checkNodeVersion also retains older Node thresholds.
- Docs deployment is a privileged workflow_run artifact boundary: the job checks repository identity and artifact presence, but the inspected gating does not require workflow_run.conclusion == success despite the header comment.