stryker-mutator/stryker-js

The inspected sensitive boundaries are imported project code, shell commands, inherited worker environments, filesystem writes, JSON-RPC, and dashboard uploads. The sandbox is a project execution directory with dependency links and an optional in-place mode. Observations here describe source behavior and review hotspots, not confirmed vulnerabilities. Partial inspection does not establish a repository-wide absence of authentication, validation, or security tests.

• JavaScript configuration and plugin descriptors execute through dynamic module imports, including resolved absolute/relative paths; configuration or plugin selection therefore crosses a trusted-code execution boundary.
  packages/core/src/config/config-reader.ts#L168-L175packages/core/src/di/plugin-loader.ts#L104-L120packages/core/src/di/plugin-loader.ts#L169-L177
• CommandTestRunner passes configured command text to child_process.exec with the current environment; Sandbox also executes buildCommand. These are intentional shell/process execution surfaces requiring trusted project configuration.
  packages/core/src/test-runner/command-test-runner.ts#L94-L106packages/core/src/sandbox/sandbox.ts#L102-L114
• inPlace selects cwd, backs up changed files, overwrites originals, and restores backups on disposal; original-file recovery is a high-impact lifecycle boundary.
  packages/core/src/sandbox/sandbox.ts#L55-L64packages/core/src/sandbox/sandbox.ts#L166-L195packages/core/src/fs/project-file.ts#L69-L94
• Sandbox shares node_modules through symlinks and may locate dependencies in parent directories, while worker forks inherit process.env; the inspected mechanisms provide execution separation without removing host dependencies or environment access.
  packages/core/src/sandbox/sandbox.ts#L118-L156packages/core/src/child-proxy/child-process-proxy.ts#L75-L84
• The inspected server start path registers configure/discover/mutationTest directly and accepts socket connections without an authentication check there; CLI defaults to localhost but permits an address override.
  packages/core/src/stryker-server.ts#L127-L149packages/core/src/stryker-server.ts#L188-L199packages/core/src/stryker-cli.ts#L111-L119
• Incremental reports are JSON-parsed without schema/version validation, explicitly noted by a TODO, and their configured path is written with recursive parent-directory creation; malformed cache input can propagate errors beyond simple parsing.
  packages/core/src/fs/project-reader.ts#L412-L432packages/core/src/fs/project-reader.ts#L453-L465packages/core/src/reporters/mutation-test-report-helper.ts#L189-L199
• Full dashboard uploads can include original sources, tests, configuration, and projectRoot; DashboardReporterClient sends an X-Api-Key from STRYKER_DASHBOARD_API_KEY to configured baseUrl and trace-logs the serialized report.
  packages/core/src/reporters/dashboard-reporter/dashboard-reporter.ts#L56-L66packages/core/src/reporters/mutation-test-report-helper.ts#L243-L254packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L41-L57packages/core/src/reporters/dashboard-reporter/dashboard-reporter-client.ts#L73-L82
• Vitest integration branches on framework versions, accesses ctx.state internals, and clears filesMap as an acknowledged hack; baseline path remapping separately assumes type-check suppression shifts test lines by exactly one.
  packages/vitest-runner/src/vitest-test-runner.ts#L94-L118packages/vitest-runner/src/vitest-test-runner.ts#L290-L294packages/core/src/process/3-dry-run-executor.ts#L196-L204