AI-co-authored code left console.warn calls in production paths, exposing internal queue sizes, component names, and query fragments to user-facing consoles.

How AI contributed: Direct introductionPublished Jul 2, 2026 in asymmetric-effort/specifyjsAll 7 findings in this repository

Show full advisory description

CWE-209 information exposure: console.warn calls in core/src/core/scheduler.ts (queue overflow), core/src/hooks/dispatcher.ts (hook queue overflow), and core/src/client/graphql.ts (gql metacharacter interpolation) were not gated behind a production check, so internal framework state (queue sizes, component names, query fragments) appears in user-facing browser consoles in production builds.

Root cause

Resource abuse & availability introduced

security: fix all SAST findings (Critical through Low)

AI-assisted change: Claude

caa8fbfa4d

core/src/client/graphql.ts core/src/core/scheduler.ts

Fix

Security fix

security: v0.2.139 — suppress console warnings in production (PT-012)

AI-assisted fix: Claude Code · Sam Caldwell

2ef791bc73

core/src/hooks/dispatcher.ts core/src/shared/warnings.ts core/src/core/scheduler.ts

Case facts

GHSA ID: GHSA-QCR8-X557-7CP3
Published: Jul 2, 2026
Severity: Not scored
Language: TypeScript
AI tool: Claude
AI role: Direct introduction
Vulnerable release: <= 0.2.137

Advisory source

AI-assisted change

AI-assisted changecore/src/client/graphql.ts source asymmetric-effort/specifyjs@caa8fbfa4d+17−1

@@ -5,6 +5,7 @@ // SPDX-License-Identifier: MIT  import { useState, useEffect, useRef, useCallback } from '../hooks/index';

Show 5 hidden lines

+import { assertSecureUrl } from '../shared/secure-fetch';  // --------------------------------------------------------------------------- // Types@@ -63,7 +64,16 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string

   for (let i = 0; i < strings.length; i++) {     result += strings[i];     if (i < values.length) {-      result += String(values[i]);+      const val = String(values[i]);+      // M-8: Warn if interpolated values contain GraphQL metacharacters+      if (/[{}():]/.test(val)) {+        if (typeof console !== 'undefined') {

Show 36 hidden lines

+          console.warn(+            '[SpecifyJS] gql: Interpolated value contains GraphQL metacharacters. Use variables parameter instead of string interpolation to prevent injection.',+          );+        }+      }+      result += val;     }   }   return result.replace(/\s+/g, ' ').trim();@@ -79,6 +89,7 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient {   const { url, headers: configHeaders, credentials, cache: cacheEnabled = false } = config; +  const MAX_CACHE_SIZE = 100;   const responseCache = new Map<string, GraphQLResponse<unknown>>();    function buildCacheKey(query: string, variables?: Record<string, unknown>): string {@@ -96,6 +107,7 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient      const body = JSON.stringify({ query, variables }); +    assertSecureUrl(url);     const response = await fetch(url, {       method: 'POST',       headers: reqHeaders,@@ -128,6 +140,10 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient           return cached as GraphQLResponse<T>;         }         const result = await execute<T>(query, variables);+        if (responseCache.size >= MAX_CACHE_SIZE) {+          const oldest = responseCache.keys().next().value;+          if (oldest !== undefined) responseCache.delete(oldest);+        }         responseCache.set(key, result);         return result;       }

The gql template tag now emits a console.warn whenever an interpolated value contains GraphQL metacharacters, and the response cache adds a bounded size policy. Values that flow from requests into interpolated positions can trigger this warning (and cache churn) on every call.

AI-assisted changecore/src/core/scheduler.ts source asymmetric-effort/specifyjs@caa8fbfa4d+8−0

@@ -8,6 +8,7 @@  type Task = () => void; +const MAX_PENDING_TASKS = 10000; let isBatchingUpdates = false; let pendingTasks: Task[] = [];

Show 14 hidden lines

@@ -17,6 +18,13 @@ let pendingTasks: Task[] = [];  */ export function scheduleUpdate(task: Task): void {   if (isBatchingUpdates) {+    if (pendingTasks.length >= MAX_PENDING_TASKS) {+      if (typeof console !== 'undefined')+        console.warn(+          '[SpecifyJS] Scheduler: pending task queue exceeded 10000 — dropping oldest tasks',+        );+      pendingTasks = pendingTasks.slice(-Math.floor(MAX_PENDING_TASKS / 2));+    }     pendingTasks.push(task);     return;   }

scheduleUpdate also prints a warning path when the pending task queue exceeds a fixed ceiling, giving another amplification channel where attacker-influenced update floods turn into repeated console output and queue trimming.

Security fix

Fixcore/src/hooks/dispatcher.ts source asymmetric-effort/specifyjs@2ef791bc73+4−1

@@ -96,7 +96,10 @@ export function useStateImpl<T>(     const lane = requestUpdateLane();     /* v8 ignore start -- overflow guard tested in security regression tests */     if (queue.length >= 10000) {-      if (typeof console !== 'undefined')+      if (+        typeof console !== 'undefined' &&+        !(typeof process !== 'undefined' && process.env?.NODE_ENV === 'production')+      )         console.warn('[SpecifyJS] Hook update queue exceeded 10000 — dropping oldest updates');       queue.splice(0, queue.length - 5000);

Show 1 hidden lines

The dispatcher gate for the update-queue warning now checks the production environment flag, so the log-flooding path is suppressed in released builds where NODE_ENV is production.

Fixcore/src/shared/warnings.ts source asymmetric-effort/specifyjs@2ef791bc73+11−1

@@ -3,16 +3,24 @@  /**  * Warning system for development-time diagnostics.- * Warnings are suppressed in production builds.+ * Warnings are suppressed in production builds (NODE_ENV === 'production').  */  const MAX_WARNINGS = 1000; const warnedMessages = new Set<string>(); +/** True when running in a production environment. Bundlers tree-shake the guarded code. */+const IS_PRODUCTION =+  typeof process !== 'undefined' &&+  typeof process.env !== 'undefined' &&+  process.env.NODE_ENV === 'production';+ /**  * Issue a one-time warning (deduplicated by message).+ * Suppressed in production builds.  */ export function warn(message: string): void {+  if (IS_PRODUCTION) return;   if (warnedMessages.has(message)) return;   if (warnedMessages.size >= MAX_WARNINGS) return;   warnedMessages.add(message);

Show 4 hidden lines

@@ -25,8 +33,10 @@ export function warn(message: string): void {  /**  * Issue an error-level warning.

+ * Suppressed in production builds.  */ export function error(message: string): void {+  if (IS_PRODUCTION) return;   if (typeof console !== 'undefined') {     // eslint-disable-next-line no-console     console.error(`[SpecifyJS] ${message}`);

warn and error both short-circuit immediately when the process reports a production environment, meaning warning strings that attacker-influenced paths could trigger never reach the console in shipped deployments.

Fixcore/src/core/scheduler.ts source asymmetric-effort/specifyjs@2ef791bc73+4−1

@@ -19,7 +19,10 @@ let pendingTasks: Task[] = []; export function scheduleUpdate(task: Task): void {   if (isBatchingUpdates) {     if (pendingTasks.length >= MAX_PENDING_TASKS) {-      if (typeof console !== 'undefined')+      if (+        typeof console !== 'undefined' &&+        !(typeof process !== 'undefined' && process.env?.NODE_ENV === 'production')+      )         console.warn(           '[SpecifyJS] Scheduler: pending task queue exceeded 10000 — dropping oldest tasks',

Show 1 hidden lines

);

The scheduler warning follows the same production gate as the dispatcher, so queued updates can no longer be turned into repeated console output in deployed software.

Patch fingerprints

AI-assisted change 7f92ab12c89f5a62c7fe2e63ef6833288008ea4cacaf3b2245e1ffb580fd252e · Fix b210c79bf70fe116cbc3bed08fb91ed01bddec3d233b3e987245fa4cb44706fa

AI-co-authored code left console.warn calls in production paths, exposing internal queue sizes, component names, and query fragments to user-facing consoles.

Show full advisory description

AI-assisted change

AI-assisted changecore/src/client/graphql.ts source asymmetric-effort/specifyjs@caa8fbfa4d+17−1

@@ -5,6 +5,7 @@ // SPDX-License-Identifier: MIT  import { useState, useEffect, useRef, useCallback } from '../hooks/index';

Show 5 hidden lines

+import { assertSecureUrl } from '../shared/secure-fetch';  // --------------------------------------------------------------------------- // Types@@ -63,7 +64,16 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string

   for (let i = 0; i < strings.length; i++) {     result += strings[i];     if (i < values.length) {-      result += String(values[i]);+      const val = String(values[i]);+      // M-8: Warn if interpolated values contain GraphQL metacharacters+      if (/[{}():]/.test(val)) {+        if (typeof console !== 'undefined') {

Show 36 hidden lines

+          console.warn(+            '[SpecifyJS] gql: Interpolated value contains GraphQL metacharacters. Use variables parameter instead of string interpolation to prevent injection.',+          );+        }+      }+      result += val;     }   }   return result.replace(/\s+/g, ' ').trim();@@ -79,6 +89,7 @@ export function gql(strings: TemplateStringsArray, ...values: unknown[]): string export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient {   const { url, headers: configHeaders, credentials, cache: cacheEnabled = false } = config; +  const MAX_CACHE_SIZE = 100;   const responseCache = new Map<string, GraphQLResponse<unknown>>();    function buildCacheKey(query: string, variables?: Record<string, unknown>): string {@@ -96,6 +107,7 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient      const body = JSON.stringify({ query, variables }); +    assertSecureUrl(url);     const response = await fetch(url, {       method: 'POST',       headers: reqHeaders,@@ -128,6 +140,10 @@ export function createGraphQLClient(config: GraphQLClientConfig): GraphQLClient           return cached as GraphQLResponse<T>;         }         const result = await execute<T>(query, variables);+        if (responseCache.size >= MAX_CACHE_SIZE) {+          const oldest = responseCache.keys().next().value;+          if (oldest !== undefined) responseCache.delete(oldest);+        }         responseCache.set(key, result);         return result;       }

AI-assisted changecore/src/core/scheduler.ts source asymmetric-effort/specifyjs@caa8fbfa4d+8−0

@@ -8,6 +8,7 @@  type Task = () => void; +const MAX_PENDING_TASKS = 10000; let isBatchingUpdates = false; let pendingTasks: Task[] = [];

Show 14 hidden lines

@@ -17,6 +18,13 @@ let pendingTasks: Task[] = [];  */ export function scheduleUpdate(task: Task): void {   if (isBatchingUpdates) {+    if (pendingTasks.length >= MAX_PENDING_TASKS) {+      if (typeof console !== 'undefined')+        console.warn(+          '[SpecifyJS] Scheduler: pending task queue exceeded 10000 — dropping oldest tasks',+        );+      pendingTasks = pendingTasks.slice(-Math.floor(MAX_PENDING_TASKS / 2));+    }     pendingTasks.push(task);     return;   }

Security fix

Fixcore/src/hooks/dispatcher.ts source asymmetric-effort/specifyjs@2ef791bc73+4−1

@@ -96,7 +96,10 @@ export function useStateImpl<T>(     const lane = requestUpdateLane();     /* v8 ignore start -- overflow guard tested in security regression tests */     if (queue.length >= 10000) {-      if (typeof console !== 'undefined')+      if (+        typeof console !== 'undefined' &&+        !(typeof process !== 'undefined' && process.env?.NODE_ENV === 'production')+      )         console.warn('[SpecifyJS] Hook update queue exceeded 10000 — dropping oldest updates');       queue.splice(0, queue.length - 5000);

Show 1 hidden lines

The dispatcher gate for the update-queue warning now checks the production environment flag, so the log-flooding path is suppressed in released builds where NODE_ENV is production.

Fixcore/src/shared/warnings.ts source asymmetric-effort/specifyjs@2ef791bc73+11−1

@@ -3,16 +3,24 @@  /**  * Warning system for development-time diagnostics.- * Warnings are suppressed in production builds.+ * Warnings are suppressed in production builds (NODE_ENV === 'production').  */  const MAX_WARNINGS = 1000; const warnedMessages = new Set<string>(); +/** True when running in a production environment. Bundlers tree-shake the guarded code. */+const IS_PRODUCTION =+  typeof process !== 'undefined' &&+  typeof process.env !== 'undefined' &&+  process.env.NODE_ENV === 'production';+ /**  * Issue a one-time warning (deduplicated by message).+ * Suppressed in production builds.  */ export function warn(message: string): void {+  if (IS_PRODUCTION) return;   if (warnedMessages.has(message)) return;   if (warnedMessages.size >= MAX_WARNINGS) return;   warnedMessages.add(message);

Show 4 hidden lines

@@ -25,8 +33,10 @@ export function warn(message: string): void {  /**  * Issue an error-level warning.

+ * Suppressed in production builds.  */ export function error(message: string): void {+  if (IS_PRODUCTION) return;   if (typeof console !== 'undefined') {     // eslint-disable-next-line no-console     console.error(`[SpecifyJS] ${message}`);

Fixcore/src/core/scheduler.ts source asymmetric-effort/specifyjs@2ef791bc73+4−1

@@ -19,7 +19,10 @@ let pendingTasks: Task[] = []; export function scheduleUpdate(task: Task): void {   if (isBatchingUpdates) {     if (pendingTasks.length >= MAX_PENDING_TASKS) {-      if (typeof console !== 'undefined')+      if (+        typeof console !== 'undefined' &&+        !(typeof process !== 'undefined' && process.env?.NODE_ENV === 'production')+      )         console.warn(           '[SpecifyJS] Scheduler: pending task queue exceeded 10000 — dropping oldest tasks',

Show 1 hidden lines

);

The scheduler warning follows the same production gate as the dispatcher, so queued updates can no longer be turned into repeated console output in deployed software.