jsdom@30.1.1 security report

Uses new Function()/Function() to dynamically compile JavaScript from strings (event handler content attributes) and executes it via .call() on event dispatch. While this is intentional and spec-compliant for jsdom's event handler attribute emulation, dynamic code execution from string content is a notable risk pattern.

Constructs functions via document.defaultView.Function with generated with scope-chain wrapper code and invokes them. The body variable is derived from attribute content, effectively evaluating attacker-controllable strings.

The loadFrame function explicitly handles URLs with the 'javascript:' scheme and calls evaluateJavaScriptURL(contentWindow, url). This executes arbitrary JavaScript supplied via a frame's src attribute (e.g. <iframe src="javascript:...">). While this mimics browser behavior and is constrained to the jsdom window context, it constitutes dynamic code execution from user-controlled input and is a known XSS-style vector if jsdom content is ever treated as trusted or if scripts are enabled.

evaluateJavaScriptURL from ../window/navigation is invoked with a URL object derived from the frame's src attribute. Depending on its implementation, this can lead to eval/new Function-style execution of attacker-influenced script. This is the only dynamic code-execution sink in the file.

External scripts are fetched via resourceLoader.fetch() using a URL derived from the 'src' attribute. The URL is parsed and serialized, but the fetch itself can load arbitrary remote content that is then executed via vm.runInContext().

The code uses vm.runInContext() to execute JavaScript from script elements, including external scripts fetched over the network. While this is expected behavior for a DOM implementation like jsdom, executing untrusted script content is inherently risky if the library is used to process untrusted HTML.

The function percent-decodes the javascript: URL payload and then UTF-8 decodes it before evaluation. Decoding before execution can bypass naive filters and allows encoded payloads (e.g. percent-encoded alert() or fetch() calls) to be executed, increasing the risk if callers rely on simple string checks on the URL.

The evaluateJavaScriptURL function decodes a javascript: URL and runs it via window.eval(). While this is gated behind runScripts === 'dangerously' (an explicit opt-in that jsdom documents as unsafe), it is still a dynamic code execution primitive that can execute arbitrary script if untrusted input reaches a navigation call.

navigate() dispatches javascript: scheme URLs to evaluateJavaScriptURL via a queued task. Any caller that can influence navigation (e.g. window.location assignment driven by user input) can trigger arbitrary script evaluation when runScripts is set to 'dangerously'.

The 'define' and 'mixin' functions copy property descriptors from a source object to a target. The mixin function skips keys already in target, but define does not. If untrusted input is passed as the 'properties' or 'source' argument, an attacker could inject '__proto__' or 'constructor' descriptors, potentially leading to prototype pollution.