CodeVetter · Repo Unpack · Risk map
stylelint/stylelint
The main sensitive boundaries are executable extensions, arbitrary configured filesystem paths, cache invalidation, and privileged workflow automation. Several source details warrant focused regression checks, particularly custom cwd handling and shared mutable state. Observations below describe behavior or explicitly labeled hypotheses; they are not confirmed vulnerabilities.
- Plugin, processor, syntax, loader, and formatter paths load JavaScript into the current Node process; dynamicImport directly invokes import rather than providing an execution sandbox.
- Module resolution tries the configuration directory, cwd, and global node_modules; config explorers use global search strategy, so resolution can cross the project directory boundary.
- Caller-controlled paths reach stylesheet/reference reads and fix/report writes; report output recursively creates parent directories, while FileCache can remove and recreate its configured cache file after a load failure.
- Hypothesis: heterogeneous per-file configurations need careful cache regression coverage because FileCache.calcHashOfConfig retains only its first hash, although lintSource calls it with each file's resolved config. (inferred)
- Suppression file location is resolved against standalone's cwd, but suppression entry keys are calculated using process.cwd(); persistence uses plain writeFile, and suppression matches counts rather than individual diagnostic identities.
- computeEditInfo invokes fix.apply and mutates nodes even without config.fix; it suppresses overlapping edits and records a narrowed replacement, making rule order and mutation behavior material to editor integration.
- Rule callbacks share PostCSS roots/results and are collected into promises; deprecated context.fix remains supported but is disabled for rules affected by inline disable ranges.
- The privileged workflow_run comment job consumes downloaded preview artifact metadata; postCustomComment takes output.number as its target and constructs comments from package URLs. The inspected workflow has a repository guard but no success-condition guard.