CodeVetter · Repo Unpack · Risk map
microsoft/rushstack
These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include generated-output deletion, request-derived filesystem access, installed-code execution, browser launch/install behavior, and daemon ownership. Native and hosted execution share orchestration code but differ in lifecycle capabilities. The reviewed sources also reveal dependency coupling that merits focused regression checks when changed.
- Documenter accepts an arbitrary --output-folder and MarkdownDocumenter.generateFiles calls ensureEmptyFolder on it before writing pages; a wrongly selected output path therefore has a concrete deletion blast radius.
- Explorer installs unrestricted cors() and calls app.listen(PORT) without a host argument; its registered graph and file-reading routes contain no authentication checks in the inspected parser.
- Hypothesis: Explorer’s package-json/package-spec endpoints may permit reads outside projectRoot through traversal because they interpolate request.body.projectPath without a containment check in these handlers; exploitability was not tested. (inferred)
- Explorer’s pnpmfile worker uses require(resolvedPath) and invokes hooks.readPackage; Documenter similarly requires resolved plugin entrypoints. Both execute workspace/installed JavaScript rather than merely parsing configuration.
- Daemon startup protects its POSIX runtime boundary by creating mode-0700 directories, verifying ownership and non-symlink identity, and checking socket-path length before binding; listener ownership is checked before socket/lockfile publication.
- Browser tunneling filters launch options through a per-user allowlist but also installs/imports handshake-selected Playwright versions; inspected handshake validation checks the version’s type, action, and browser name without semantic-version validation in that function.
- Webpack localization replaces GetChunkFilenameRuntimeModule.prototype.generate to capture chunk identity and relies on assetPath callback conventions; hypothesis: Webpack runtime changes or interactions with other prototype wrappers can affect this integration. (inferred)
- Native phased-command output closure stops new operations but lets started operations finish because native commands do not own their process groups; hosted-engine graph options separately enable termination support and alter runner closure.