CodeVetter · Repo Unpack · Risk map
TanStack/router
The main sensitive boundaries are URL interpretation, RPC decoding, middleware trust, SSR stream ownership, and generator filesystem access. Several protections are explicit, but their effectiveness has not been dynamically verified here. The risks below are source observations or labeled hypotheses, not confirmed vulnerabilities. Test limitations are specific to the inspected files and do not imply whole-repository absence of coverage.
- CSRF configuration changes when an application supplies a Start instance: the implicit default middleware is used only without that instance, and a missing custom CSRF middleware produces a nonproduction warning rather than automatic installation.
- CSRF validation prioritizes Sec-Fetch-Site, then Origin, then Referer; requests lacking all applicable checks are denied unless allowRequestsWithoutOriginCheck is explicitly true.
- RPC checks the declared HTTP method before parsing and applies an explicit size limit to GET payload strings; the inspected POST JSON and FormData branches invoke request parsers without that same local size check.
- Client-supplied RPC context crosses a trust boundary in GET, JSON, and FormData; safeObjectMerge places server context last, and repository instructions require preserving that precedence.
- Redirect handling rejects protocol-relative/control-character variants and schemes outside protocolAllowlist, while intentionally allowing external HTTP(S) redirects; same-origin enforcement is not a blanket redirect policy.
- SSR transport recognizes fixed byte patterns rather than parsing HTML; its documented contract requires Scripts in body and forbids an earlier exact </body></html> in raw data after the hydration boundary.
- Generator routesDirectory, generatedRouteTree, and tmpDir can resolve to absolute paths outside the project; safeFileWrite performs writes, chmod/chown, and rename at those configured locations.
- Hypothesis: a generator regression that stops throwing for an invalid fixture could escape the inspected expected-error branch, because its assertions execute only inside catch and it does not assert rejection or fail after normal completion. (inferred)