CodeVetter · Repo Unpack · Risk map
vitest-dev/vitest
The inspected sensitive boundaries include authenticated HTTP/WebSocket APIs, browser filesystem commands, executable snapshots, child processes, and persistent user-data files. Several paths already contain explicit permission checks and regression tests. The observations below identify review hotspots and existing safeguards, not confirmed vulnerabilities. Lifecycle and coverage hypotheses require targeted execution in a separately authorized environment.
- API tokens persist first in a platform-specific user-data directory, with workspace node_modules/.vitest fallback; creation uses UUIDs and restrictive modes, while configuration adds the token filename to Vite's deny list.
- API authentication uses a query token with timingSafeEqual; UI authentication additionally accepts a year-long HttpOnly strict cookie and injects the token into authorized HTML, making token-handling paths security-sensitive.
- Non-middleware API hosts other than localhost/127.0.0.1 default write and execute capabilities off; explicit settings remain effective, and API rerun, file-save, and snapshot-update handlers apply separate capability checks.
- Browser filesystem commands resolve paths against project.root and check file access; writes/removals additionally assert write permission, while browser RPC requires both project and root capabilities for CDP.
- Snapshot loading can execute file content through new Function('exports', content); Node raw snapshots accept absolute paths, and SnapshotClient documents that its same-file collision rejection is best-effort.
- Execution crosses process and command boundaries: fork workers receive env/execArgv, Git discovery invokes git through tinyexec, and interactive missing-dependency handling can call installPackage after confirmation.
- Lifecycle ordering is a coupling hotspot: source comments identify overlapping restarts and browser reconnection during shutdown as failure mechanisms; serialization of restarts and pool-before-server closure are intended safeguards.
- Hypothesis: relying on root typecheck or the scoped-fixture suite alone can miss branch-specific regressions, because several test trees are excluded and scoped-fixture tests skip under rolldownVersion. (inferred)