registry / @aooth/auth-moost / 0.1.38

@aooth/auth-moost@0.1.38

Moost auth integration for aoothjs — AuthGuard interceptor, useAuth composable, REST endpoints, workflows

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 334 KB of source

Source & flagged code

3 flagged

dist/index.mjsView file

Lines 656-696javascript

656 if (target[1] === "/" || target[1] === "\\") return false;

657 if (target.includes("\\")) return false;

658 for (let i = 0; i < target.length; i++) {

659 const code = target.charCodeAt(i);

660 if (code <= 32 || code === 127) return false;

661 }

662 return true;

663}

664/**

665* Return `requested` when it is a safe same-origin relative redirect, else

666* `fallback`. Used at `/start` (before signing) and re-checked in

667* `oauth-exchange` (before honoring) — defense in depth around the signed

668* round-trip.

669*/

670function resolveOAuthRedirect(requested, fallback) {

671 return isSafeRelativeRedirect(requested) ? requested : fallback;

672}

673//#endregion

674//#region src/authz/authz-tokens.ts

675/**

676* Explicit string DI tokens for the ABSTRACT authorization-server stores

677* ({@link import("@aooth/auth/authz").PendingAuthorizationStore},

678* {@link import("@aooth/auth/authz").AuthCodeStore}) — the framework-agnostic

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L676

679* abstracts live in `@aooth/auth/authz`; these moost-DI binding strings stay in

680* the integration layer (the same split as `FEDERATED_IDENTITY_STORE_TOKEN`).

681*

682* Both are abstract classes. moost's constructor injection keys the

683* provide-registry by the design:paramtype class reference — fine for a CONCRETE

684* provided class, but for an abstract paramtype infact falls back to auto-

685* instantiating the body-less abstract class, yielding an object whose methods

686* are missing. Binding under an explicit string token + `@Inject(<token>)`

687* sidesteps the class-reference path (the same pattern as

688* `FEDERATED_IDENTITY_STORE_TOKEN`).

689*

690* Consumers provide the concrete instance under the exact string:

691*

692* ```ts

693* createProvideRegistry(

694* [PENDING_AUTHORIZATION_STORE_TOKEN, () => new PendingAuthorizationStoreMemory()],

695* [AUTH_CODE_STORE_TOKEN, () => new AuthCodeStoreMemory()],

696* )

Lines 3306-3346javascript

3306 * Manage-MFA password re-auth — the step-up FALLBACK when the user's only

3307 * confirmed factor(s) are of kinds the policy no longer allows, so nothing is

3308 * MFA-challengeable (`addMfa.stepUpMode === "password"`; see `init-add-mfa`).

3309 * Pauses on `PasswordReauthForm`, verifies the account password via

Lines 4985-5025javascript

4985 if (cooldown && Date.now() < cooldown) {

4986 const waitSec = Math.ceil((cooldown - Date.now()) / 1e3);

4987 throw this.throwPublic(ctx, wf, { formMessage: `Please wait ${waitSec}s before requesting another code` });

4988 }

Source & flagged code

3 flagged · loading source

dist/index.mjsView file

3326patternName = generic_password severity = medium line = 3326 matchedText = if (!awa... });

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.mjsView on unpkg · L3326

676* Explicit string DI tokens for the ABSTRACT authorization-server stores L677: * ({@link import("@aooth/auth/authz").PendingAuthorizationStore}, L678: * {@link import("@aooth/auth/authz").AuthCodeStore}) — the framework-agnostic

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L676

5005patternName = generic_password severity = medium line = 5005 matchedText = throw th... });

Medium

Secret Pattern

Hardcoded password in dist/index.mjs

dist/index.mjsView on unpkg · L5005

Findings

3 Medium3 Low

MediumSecret Patterndist/index.mjs

MediumDynamic Requiredist/index.mjs

MediumSecret Patterndist/index.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

dist/index.mjsView file

Lines 656-696javascript

656 if (target[1] === "/" || target[1] === "\\") return false;

657 if (target.includes("\\")) return false;

658 for (let i = 0; i < target.length; i++) {

659 const code = target.charCodeAt(i);

660 if (code <= 32 || code === 127) return false;

661 }

662 return true;

663}

664/**

665* Return `requested` when it is a safe same-origin relative redirect, else

666* `fallback`. Used at `/start` (before signing) and re-checked in

667* `oauth-exchange` (before honoring) — defense in depth around the signed

668* round-trip.

669*/

670function resolveOAuthRedirect(requested, fallback) {

671 return isSafeRelativeRedirect(requested) ? requested : fallback;

672}

673//#endregion

674//#region src/authz/authz-tokens.ts

675/**

676* Explicit string DI tokens for the ABSTRACT authorization-server stores

677* ({@link import("@aooth/auth/authz").PendingAuthorizationStore},

678* {@link import("@aooth/auth/authz").AuthCodeStore}) — the framework-agnostic

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L676

679* abstracts live in `@aooth/auth/authz`; these moost-DI binding strings stay in

680* the integration layer (the same split as `FEDERATED_IDENTITY_STORE_TOKEN`).

681*

682* Both are abstract classes. moost's constructor injection keys the

683* provide-registry by the design:paramtype class reference — fine for a CONCRETE

684* provided class, but for an abstract paramtype infact falls back to auto-

685* instantiating the body-less abstract class, yielding an object whose methods

686* are missing. Binding under an explicit string token + `@Inject(<token>)`

687* sidesteps the class-reference path (the same pattern as

688* `FEDERATED_IDENTITY_STORE_TOKEN`).

689*

690* Consumers provide the concrete instance under the exact string:

691*

692* ```ts

693* createProvideRegistry(

694* [PENDING_AUTHORIZATION_STORE_TOKEN, () => new PendingAuthorizationStoreMemory()],

695* [AUTH_CODE_STORE_TOKEN, () => new AuthCodeStoreMemory()],

696* )

Lines 3306-3346javascript

3306 * Manage-MFA password re-auth — the step-up FALLBACK when the user's only

3307 * confirmed factor(s) are of kinds the policy no longer allows, so nothing is

3308 * MFA-challengeable (`addMfa.stepUpMode === "password"`; see `init-add-mfa`).

3309 * Pauses on `PasswordReauthForm`, verifies the account password via

Lines 4985-5025javascript

4985 if (cooldown && Date.now() < cooldown) {

4986 const waitSec = Math.ceil((cooldown - Date.now()) / 1e3);

4987 throw this.throwPublic(ctx, wf, { formMessage: `Please wait ${waitSec}s before requesting another code` });

4988 }