CodeVetter · Repo Unpack · Risk map
storybookjs/storybook
The principal sensitive boundaries are dev-server access, source-file rewriting, output-directory deletion, package execution, and instance-token persistence. The source contains safeguards, including token comparison, Host checks, and owner-only registry permissions. Findings below are source observations or explicitly labeled hypotheses, not confirmed vulnerabilities. Partial inspection cannot establish whole-repository test gaps or the absence of additional protections.
- WebSocket upgrades validate a supplied Origin and token unless skipValidation is set; non-browser clients may omit Origin, and buildDevStandalone sets skipValidation for WebContainer environments.
- Host validation permits all hosts when allowedHosts is true or host is 0.0.0.0 with an empty allowlist; startup warns about the latter configuration.
- Hypothesis requiring wider validation: SAVE_STORY_REQUEST accepts importPath and joins it to process.cwd() before reading and writing; the inspected handler does not bind that path to an indexed entry or check containment, making the upstream channel trust boundary consequential. (inferred)
- buildStaticStandalone recursively removes the resolved outputDir before loading configuration; its visible guards reject empty input and '/', so output-path handling has a filesystem-wide potential blast radius.
- Instance discovery persists the WebSocket token outside the project under .storybook/instances; records are written through a restricted temporary file and rename, with chmod and Windows icacls enforcement.
- External CLI dispatch can execute an installed package binary or download/run a versioned package through the detected package manager, making command routing a process and package-supply boundary.
- Tools attachment depends on import order: STORYBOOK_ATTACHED_TOOLS must be set before loading runtime machinery so UniversalStore becomes a follower; cross-installation attachment spawns the recorded installation rather than mixing module copies.
- Accessibility results are not universally fatal: default addon parameters use todo, checks skip several configured cases, and caught errors are rethrown only for standalone Vitest runs.