CodeVetter · Repo Unpack · Risk map
remix-run/react-router
The observations below identify security and correctness boundaries, not confirmed vulnerabilities. Cookie signing, filesystem identifiers, client/server module separation, request origins, and proxy-derived URLs deserve focused review when changed. The shared navigation engine has a large behavioral blast radius because cancellation, hydration, actions, and loading meet there. Runtime failures, deployment policy, and uninspected tests remain unverified.
- Cookie signing is optional: createCookie defaults secrets to an empty array, while session storage warns about unsigned cookies rather than rejecting them.
- Cookie session content is JSON/base64 encoded and optionally HMAC signed, so signing supplies integrity rather than encryption.
- The cookie defaults shown set path and sameSite=lax; this default construction does not set secure or httpOnly.
- File storage performs filesystem IO beneath a caller-selected dir, and getFile rejects identifiers outside the 16-character hexadecimal format before path construction.
- Hypothesis: concurrent file-session updates merit additional verification because updateData directly overwrites JSON without locking or atomic replacement in the inspected implementation. (inferred)
- Document mutation requests invoke throwIfPotentialCSRFAttack with configured allowedActionOrigins and return 400 when that check throws.
- Express request URL construction depends on trust proxy, forwarded host/host ports, and req.protocol; hostname delimiters are stripped before URL creation.
- Client/server separation depends on both removal of server-only route exports and the dot-server resolve hook rejecting surviving client references.
- Application scaffolding can launch package-manager installation through child_process.spawn with a supplied working directory.
- The shared navigation path aborts previous work and later commits combined action, loader, error, and fetcher state, making edits here relevant across several observable behaviors.
- Typegen removes generated directories before writing, and root clean scripts invoke git clean; these commands have filesystem side effects and were not run.