registry / @fluidframework/container-loader / 2.111.0

@fluidframework/container-loader@2.111.0

Fluid container loader

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcess

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 118 file(s), 1.27 MB of source

Source & flagged code

1 flagged

dist/connectionStateHandler.jsView file

Lines 1-27javascript

1"use strict";

2/*!

4 * Licensed under the MIT License.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.ConnectionStateHandler = exports.ConnectionStateCatchup = exports.createConnectionStateHandlerCore = exports.createConnectionStateHandler = void 0;

8const core_interfaces_1 = require("@fluidframework/core-interfaces");

9const internal_1 = require("@fluidframework/core-utils/internal");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/connectionStateHandler.jsView on unpkg · L7

10const internal_2 = require("@fluidframework/telemetry-utils/internal");

11const catchUpMonitor_js_1 = require("./catchUpMonitor.js");

12const connectionState_js_1 = require("./connectionState.js");

13// Based on recent data, it looks like majority of cases where we get stuck are due to really slow or

14// timing out ops fetches. So attempt recovery infrequently. Also fetch uses 30 second timeout, so

15// if retrying fixes the problem, we should not see these events.

16const JoinOpTimeoutMs = 45000;

17// Timeout waiting for "self" join signal, before giving up

18const JoinSignalTimeoutMs = 10000;

19function createConnectionStateHandler(inputs, deltaManager, clientId) {

20 const config = inputs.mc.config;

21 return createConnectionStateHandlerCore(config.getBoolean("Fluid.Container.DisableCatchUpBeforeDeclaringConnected") !== true, // connectedRaisedWhenCaughtUp

22 config.getBoolean("Fluid.Container.DisableJoinSignalWait") !== true, // readClientsWaitForJoinSignal

23 inputs, deltaManager, clientId);

24}

25exports.createConnectionStateHandler = createConnectionStateHandler;

26function createConnectionStateHandlerCore(connectedRaisedWhenCaughtUp, readClientsWaitForJoinSignal, inputs, deltaManager, clientId) {

27 const factory = (handler) => new ConnectionStateHandler(handler, readClientsWaitForJoinSignal, clientId);

Source & flagged code

1 flagged · loading source

dist/connectionStateHandler.jsView file

7package = @fluidframework/container-loader; repositoryIdentity = fluidframework; dependency = @fluidframework/core-interfaces L7: exports.ConnectionStateHandler = exports.ConnectionStateCatchup = exports.[redacted] = exports.createConnectionStateHandler = void 0; L8: const core_interfaces_1 = require("@fluidframework/core-interfaces"); L9: const internal_1 = require("@fluidframework/core-utils/internal");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/connectionStateHandler.jsView on unpkg · L7

Findings

1 High1 Medium1 Low

HighCopied Package Dependency Bridgedist/connectionStateHandler.js

MediumStructural Risk Force Deep Review

LowScripts Present

Source & flagged code

1 flagged

dist/connectionStateHandler.jsView file

Lines 1-27javascript

1"use strict";

2/*!

4 * Licensed under the MIT License.

5 */

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.ConnectionStateHandler = exports.ConnectionStateCatchup = exports.createConnectionStateHandlerCore = exports.createConnectionStateHandler = void 0;

8const core_interfaces_1 = require("@fluidframework/core-interfaces");

9const internal_1 = require("@fluidframework/core-utils/internal");

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/connectionStateHandler.jsView on unpkg · L7

10const internal_2 = require("@fluidframework/telemetry-utils/internal");

11const catchUpMonitor_js_1 = require("./catchUpMonitor.js");

12const connectionState_js_1 = require("./connectionState.js");

13// Based on recent data, it looks like majority of cases where we get stuck are due to really slow or

14// timing out ops fetches. So attempt recovery infrequently. Also fetch uses 30 second timeout, so

15// if retrying fixes the problem, we should not see these events.

16const JoinOpTimeoutMs = 45000;

17// Timeout waiting for "self" join signal, before giving up

18const JoinSignalTimeoutMs = 10000;

19function createConnectionStateHandler(inputs, deltaManager, clientId) {

20 const config = inputs.mc.config;

21 return createConnectionStateHandlerCore(config.getBoolean("Fluid.Container.DisableCatchUpBeforeDeclaringConnected") !== true, // connectedRaisedWhenCaughtUp

22 config.getBoolean("Fluid.Container.DisableJoinSignalWait") !== true, // readClientsWaitForJoinSignal

23 inputs, deltaManager, clientId);

24}

25exports.createConnectionStateHandler = createConnectionStateHandler;

26function createConnectionStateHandlerCore(connectedRaisedWhenCaughtUp, readClientsWaitForJoinSignal, inputs, deltaManager, clientId) {

27 const factory = (handler) => new ConnectionStateHandler(handler, readClientsWaitForJoinSignal, clientId);