AI-written code allowed unrestricted data: URIs, enabling memory exhaustion via very large payloads.

+ * HTTPS or be relative URLs. This prevents data from being transmitted+ * in plaintext, protecting against eavesdropping and MITM attacks.+ *+ * Exceptions:+ * - Relative URLs (./path, /path) — resolved by the browser+ * - localhost and 127.0.0.1 — development only+ */++/**+ * Validate that a URL uses HTTPS or is a relative/localhost URL.+ * Throws if the URL uses plaintext HTTP.+ */+export function assertSecureUrl(url: string): void {+  // Relative URLs are always allowed+  if (url.startsWith('/') || url.startsWith('./') || url.startsWith('../')) {+    return;+  }++  // Data URLs are allowed+  if (url.startsWith('data:')) {+    return;+  }++  // Parse absolute URLs+  let parsed: URL;+  try {+    parsed = new URL(url, typeof window !== 'undefined' ? window.location.href : undefined);+  } catch {+    // If URL can't be parsed, allow it (likely a relative path the browser will resolve)+    return;+  }++  // Allow HTTPS+  if (parsed.protocol === 'https:') {+    return;+  }++  // Allow localhost/127.0.0.1 for development (any protocol)+  if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {+    return;+  }++  // Reject HTTP and other insecure protocols+  throw new Error(+    `[LiquidJS] Insecure URL rejected: "${url}". ` ++      `LiquidJS enforces HTTPS-only for all network requests. ` ++      `Use https:// or a relative URL. ` ++      `Localhost URLs are allowed for development.`,+  );+}++/**+ * Secure fetch — drop-in replacement for window.fetch that enforces HTTPS.+ * Use this instead of fetch() directly to comply with the HTTPS-only policy.+ */+export function secureFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {+  const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;+  assertSecureUrl(url);+  return fetch(input, init);+}

+//+//	liquidjs-cert [options]+//	  -out string    Output directory (default "certs")+//	  -cn string     Common name for leaf cert (default "localhost")+//	  -sans string   Comma-separated SANs (default "localhost,127.0.0.1")+//	  -days int      Certificate validity in days (default 365)+//	  -ca-days int   CA validity in days (default 3650)+package main++import (+	"crypto/ecdsa"+	"crypto/elliptic"+	"crypto/rand"+	"crypto/x509"+	"crypto/x509/pkix"+	"encoding/pem"+	"flag"+	"fmt"+	"math/big"+	"net"+	"os"+	"path/filepath"+	"strings"+	"time"+)++func main() {+	outDir := flag.String("out", "certs", "Output directory for certificate files")+	cn := flag.String("cn", "localhost", "Common name for leaf certificate")+	sans := flag.String("sans", "localhost,127.0.0.1", "Comma-separated Subject Alternative Names")+	days := flag.Int("days", 365, "Leaf certificate validity in days")+	caDays := flag.Int("ca-days", 3650, "CA certificate validity in days")+	flag.Parse()++	if err := os.MkdirAll(*outDir, 0o755); err != nil {+		fatalf("create output dir: %v", err)+	}++	// Generate CA+	caKey, caCert, caCertBytes := generateCA(*caDays)+	writeFile(filepath.Join(*outDir, "ca.pem"), pemEncode("CERTIFICATE", caCertBytes))+	writeFile(filepath.Join(*outDir, "ca-key.pem"), pemEncodeECKey(caKey))++	// Generate leaf certificate+	leafKey, leafCertBytes := generateLeaf(caKey, caCert, *cn, *sans, *days)+	writeFile(filepath.Join(*outDir, "cert.pem"), pemEncode("CERTIFICATE", leafCertBytes))+	writeFile(filepath.Join(*outDir, "key.pem"), pemEncodeECKey(leafKey))++	fmt.Printf("Certificates generated in %s/\n", *outDir)+	fmt.Printf("  CA:   ca.pem, ca-key.pem (valid %d days)\n", *caDays)+	fmt.Printf("  Leaf: cert.pem, key.pem (CN=%s, valid %d days)\n", *cn, *days)+	fmt.Printf("  SANs: %s\n", *sans)+	fmt.Println()+	fmt.Println("To trust the CA on macOS:")+	fmt.Printf("  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain %s/ca.pem\n", *outDir)+	fmt.Println()+	fmt.Println("To trust the CA on Linux:")+	fmt.Printf("  sudo cp %s/ca.pem /usr/local/share/ca-certificates/liquidjs-dev.crt && sudo update-ca-certificates\n", *outDir)+}++func generateCA(validDays int) (*ecdsa.PrivateKey, *x509.Certificate, []byte) {+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)+	if err != nil {+		fatalf("generate CA key: %v", err)+	}++	serial := newSerial()+	template := &x509.Certificate{+		SerialNumber: serial,+		Subject: pkix.Name{+			Organization: []string{"LiquidJS Development CA"},+			CommonName:   "LiquidJS Dev Root CA",+		},+		NotBefore:             time.Now().Add(-1 * time.Hour),+		NotAfter:              time.Now().Add(time.Duration(validDays) * 24 * time.Hour),+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign,+		BasicConstraintsValid: true,+		IsCA:                  true,+		MaxPathLen:            1,+	}++	certBytes, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)+	if err != nil {+		fatalf("create CA cert: %v", err)+	}

+	"crypto/x509"+	"encoding/pem"+	"os"+	"path/filepath"+	"testing"+)++func TestGenerateCA(t *testing.T) {+	key, cert, certBytes := generateCA(365)++	if key == nil {+		t.Fatal("CA key is nil")+	}+	if cert == nil {+		t.Fatal("CA cert is nil")+	}+	if len(certBytes) == 0 {+		t.Fatal("CA cert bytes empty")+	}+	if !cert.IsCA {+		t.Error("CA cert should have IsCA=true")+	}+	if cert.Subject.CommonName != "LiquidJS Dev Root CA" {+		t.Errorf("CA CN = %q, want %q", cert.Subject.CommonName, "LiquidJS Dev Root CA")+	}+}++func TestGenerateLeaf(t *testing.T) {+	caKey, caCert, _ := generateCA(365)+	leafKey, leafCertBytes := generateLeaf(caKey, caCert, "localhost", "localhost,127.0.0.1", 30)++	if leafKey == nil {+		t.Fatal("leaf key is nil")+	}+	if len(leafCertBytes) == 0 {+		t.Fatal("leaf cert bytes empty")+	}++	leafCert, err := x509.ParseCertificate(leafCertBytes)+	if err != nil {+		t.Fatalf("parse leaf cert: %v", err)+	}+	if leafCert.Subject.CommonName != "localhost" {+		t.Errorf("leaf CN = %q, want %q", leafCert.Subject.CommonName, "localhost")+	}+	if len(leafCert.DNSNames) == 0 {+		t.Error("leaf cert should have DNS SANs")+	}+	if len(leafCert.IPAddresses) == 0 {+		t.Error("leaf cert should have IP SANs")+	}++	// Verify leaf is signed by CA+	roots := x509.NewCertPool()+	roots.AddCert(caCert)+	_, err = leafCert.Verify(x509.VerifyOptions{Roots: roots})+	if err != nil {+		t.Errorf("leaf cert verification failed: %v", err)+	}+}++func TestPemEncode(t *testing.T) {+	data := []byte("test data")+	encoded := pemEncode("CERTIFICATE", data)+	block, _ := pem.Decode(encoded)+	if block == nil {+		t.Fatal("PEM decode returned nil")+	}+	if block.Type != "CERTIFICATE" {+		t.Errorf("PEM type = %q, want CERTIFICATE", block.Type)+	}+}++func TestPemEncodeECKey(t *testing.T) {+	caKey, _, _ := generateCA(1)+	encoded := pemEncodeECKey(caKey)+	block, _ := pem.Decode(encoded)+	if block == nil {+		t.Fatal("PEM decode returned nil")+	}+	if block.Type != "EC PRIVATE KEY" {+		t.Errorf("PEM type = %q, want EC PRIVATE KEY", block.Type)+	}+	_, err := x509.ParseECPrivateKey(block.Bytes)+	if err != nil {

+      throw new Error('[SpecifyJS] secureFetch: data: URI exceeds 1MB limit');+    }     return;   } -  // Parse absolute URLs+  // Parse absolute URLs — reject if unparseable   let parsed: URL;   try {     parsed = new URL(url, typeof window !== 'undefined' ? window.location.href : undefined);   } catch {-    /* v8 ignore next 2 -- URL parse failure is environment-specific; jsdom always provides a base */-    return;+    throw new Error(+      `[SpecifyJS] secureFetch: unable to validate URL "${url}". ` ++        `Provide a valid absolute HTTPS URL or a relative path.`,+    );   }    // Allow HTTPS   if (parsed.protocol === 'https:') {     return;   } -  // Allow localhost/127.0.0.1 for development (any protocol)-  if (parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1') {+  // Allow localhost for development (any protocol) — covers IPv4/IPv6 loopback+  if (+    parsed.hostname === 'localhost' ||+    parsed.hostname === '127.0.0.1' ||+    parsed.hostname === '[::1]' ||+    parsed.hostname === '0.0.0.0' ||+    parsed.hostname.startsWith('127.')+  ) {     return;   } @@ -70,5 +81,7 @@ export function assertSecureUrl(url: string): void { export function secureFetch(input: string | URL | Request, init?: RequestInit): Promise<Response> {   const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;   assertSecureUrl(url);-  return fetch(input, init);+  // Default to rejecting redirects to prevent redirect-based SSRF.+  // Callers can override with { redirect: 'follow' } if they trust the target.+  return fetch(input, { redirect: 'error', ...init }); }

+**Reviewer**: Claude (AI-assisted white-box code review)+**Scope**: Full source code review of `https://github.com/asymmetric-effort/specifyjs` (v0.2.135)++## Executive Summary++Review identified **19 security findings** (0 Critical, 1 High, 4 Medium, 7 Low, 7 Informational/Positive). SpecifyJS demonstrates a strong security posture overall — zero runtime dependencies eliminate supply chain risk, HTTPS-only network policy is enforced, prototype pollution is guarded, and CI/CD practices follow best practices (SHA-pinned actions, OIDC publishing, CodeQL scanning).++The single High finding is a URL validation bypass in `secureFetch` where parse failures silently allow requests. The Medium findings involve an injectable GraphQL template tag, CSS sanitization bypass in server-side rendering, and redirect-following without re-validation. All are addressable with targeted fixes. No Critical vulnerabilities were identified.++## Scope & Methodology++- **Type**: White-box source code review (no active exploitation)+- **Coverage**: All source files (`core/src/`, `site/src/`, `components/`), configuration, dependencies, CI/CD pipelines, and infrastructure definitions+- **Standards**: OWASP Top 10 (2021), CWE/SANS Top 25, OWASP ASVS+- **Limitations**: Static analysis only. No runtime testing, no fuzzing, no network scanning. Browser-specific behavior not verified.++## Attack Surface Map++| Entry Point | Type | Authentication | Trust Level |+|---|---|---|---|+| `secureFetch(url)` | Network request | None | Semi-trusted (URL validated) |+| `graphqlClient.query()` | GraphQL over HTTPS | Optional (interceptors) | Semi-trusted |+| `restClient.get/post/...()` | REST over HTTPS | Optional (interceptors) | Semi-trusted |+| `protobufClient.call()` | gRPC-Web over HTTPS | Optional | Semi-trusted |+| `dangerouslySetInnerHTML` | Raw HTML injection | N/A (developer API) | Developer-trusted |+| `FeatureFlagProvider url` | Remote JSON config | None | Untrusted (sanitized) |+| `createElement(type, props)` | Component rendering | N/A | Developer-trusted |+| Hash router (`/#/path`) | URL navigation | None | Untrusted (browser URL) |+| Telemetry `navigator.sendBeacon` | Metrics export | None | Trusted (outbound only) |++## Findings Summary++| ID | Title | Severity | CWE | Location |+|---|---|---|---|---|+| PT-001 | URL parse failure silently allows request | High | CWE-918 | `core/src/shared/secure-fetch.ts:42` |+| PT-002 | GraphQL gql tag allows metacharacter injection | Medium | CWE-943 | `core/src/client/graphql.ts:66` |+| PT-003 | CSS expression sanitization is bypassable | Medium | CWE-79 | `core/src/server/render-to-string.ts:307` |+| PT-004 | No redirect target validation in secureFetch | Medium | CWE-918 | `core/src/shared/secure-fetch.ts` |+| PT-005 | data: URI allowed without restriction | Medium | CWE-918 | `core/src/shared/secure-fetch.ts:33` |+| PT-006 | dangerouslySetInnerHTML passes raw HTML | Low | CWE-79 | `core/src/dom/work-loop.ts:1430` |+| PT-007 | cloneElement missing constructor/prototype guard | Low | CWE-1321 | `core/src/core/clone-element.ts:43` |+| PT-008 | Localhost bypass incomplete (IPv6, 0.0.0.0) | Low | CWE-918 | `core/src/shared/secure-fetch.ts:52` |+| PT-009 | SVG foreignObject allows HTML embedding | Low | CWE-79 | `core/src/dom/work-loop.ts:743` |+| PT-010 | Source maps generated for production builds | Low | CWE-540 | `core/build.mjs:37` |+| PT-011 | Math.random() fallback for trace IDs | Low | CWE-338 | `core/src/telemetry/tracing.ts:36` |+| PT-012 | Production console warnings leak internal state | Low | CWE-209 | Multiple files |+| PT-013 | brace-expansion moderate vulnerability (dev only) | Informational | CWE-1333 | `core/node_modules/brace-expansion` |+| PT-014 | Zero runtime dependencies | Informational | — | Positive finding |+| PT-015 | Prototype pollution properly guarded | Informational | — | Positive finding |+| PT-016 | Render loop detection effective | Informational | — | Positive finding |+| PT-017 | SHA-pinned GitHub Actions | Informational | — | Positive finding |+| PT-018 | OIDC-based npm provenance publishing | Informational | — | Positive finding |+| PT-019 | No ReDoS in regex patterns | Informational | — | Positive finding |++## Detailed Findings++### PT-001: URL Parse Failure Silently Allows Request [High]++**CWE**: CWE-918 — Server-Side Request Forgery+**CVSS**: 7.5 (High)+**Location**: `core/src/shared/secure-fetch.ts:42-45`++**Description**: When `new URL()` throws a parse error, the `assertSecureUrl` function returns without throwing, silently allowing the request to proceed without HTTPS validation. An attacker who can craft a URL that fails `URL` constructor parsing but is valid for `fetch()` could bypass the HTTPS enforcement policy.++**Affected Code**:+```typescript+// core/src/shared/secure-fetch.ts, line 42+try {+    parsed = new URL(url, typeof window !== 'undefined' ? window.location.href : undefined);+} catch {+    return;  // ← silently allows unparseable URLs+}+```++**Exploit Scenario**: In a Node.js build-time context (e.g., pre-rendering) where `window` is undefined, `new URL(url)` without a base will throw for relative-looking URLs. If the pre-rendering code passes a URL that looks relative but is actually an absolute HTTP URL with unusual formatting, the validation is skipped entirely.++**Remediation**: Throw an error instead of silently allowing:+```typescript+catch {+    throw new Error(`[SpecifyJS] secureFetch: unable to validate URL "${url}"`);+}+```++---+

+    // L-6: Reject CSS values containing dangerous patterns.+    // Normalize unicode escapes and strip CSS comments before checking+    // to prevent bypass via \65xpression( or exp/**/ression( patterns.+    const normalizedCss = cssValue+      .replace(/\\[0-9a-fA-F]{1,6}\s?/g, '_')+      .replace(/\/\*[\s\S]*?\*\//g, '');+    if (/expression\s*\(|javascript\s*:|behavior\s*:|moz-binding|-o-link/i.test(normalizedCss)) {+      cssValue = '';+    }      parts.push(`${cssProp}:${cssValue}`);   }