registry / @fluidframework/datastore / 2.111.0

@fluidframework/datastore@2.111.0

Fluid data store implementation

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 3 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 297 KB of source

Source & flagged code

1 flagged

dist/dataStoreRuntime.jsView file

Lines 25-65javascript

25 return ILayerCompatDetails?.supportedFeatures.has(feature) ?? false;

26}

27/**

28 * @legacy @beta

29 */

30var DataStoreMessageType;

31(function (DataStoreMessageType) {

32 // Creates a new channel

33 DataStoreMessageType["Attach"] = "attach";

34 DataStoreMessageType["ChannelOp"] = "op";

35})(DataStoreMessageType || (exports.DataStoreMessageType = DataStoreMessageType = {}));

36/**

37 * The common URL prefix used by legacy DDS type strings.

38 * Factories originally used full URLs (e.g. `"https://graph.microsoft.com/types/map"`);

39 * new factories use only the trailing path segment (e.g. `"map"`).

40 *

41 * Support for reading both formats was added in 2.92.0.

42 * @remarks

43 * This is encoded using base64 to avoid replacement of URL-like values that we have seen some reverse proxies perform.

44 * The value at runtime is "https://graph.microsoft.com/types/".

45 */

46const legacyTypeUrlPrefix = atob("aHR0cHM6Ly9ncmFwaC5taWNyb3NvZnQuY29tL3R5cGVzLw==");

47/**

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/dataStoreRuntime.jsView on unpkg · L45

48 * Wraps an {@link ISharedObjectRegistry} to transparently redirect legacy URL-based DDS type

49 * strings to the factories registered under the corresponding short-name path segment.

50 *

51 * When a lookup by the full URL fails, this wrapper retries using only the portion of the URL

52 * after `"https://graph.microsoft.com/types/"`. This allows old documents whose summaries

53 * contain URL-based type strings to be loaded against a registry built with the current

54 * short-name factory types.

55 *

56 * @remarks

57 * See {@link legacyTypeUrlPrefix} for details on old vs. new formats

58 */

59class LegacyTypeAwareRegistry {

60 constructor(base) {

61 this.base = base;

62 }

63 get(name) {

64 let factory = this.base.get(name);

65 if (factory !== undefined) {

Source & flagged code

1 flagged · loading source

dist/dataStoreRuntime.jsView file

45*/ L46: const legacyTypeUrlPrefix = atob("[redacted]=="); L47: /**

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/dataStoreRuntime.jsView on unpkg · L45

Findings

1 High2 Low

HighBase64 Obscured Urldist/dataStoreRuntime.js

LowScripts Present

LowHigh Entropy Strings

Source & flagged code

1 flagged

dist/dataStoreRuntime.jsView file

Lines 25-65javascript

25 return ILayerCompatDetails?.supportedFeatures.has(feature) ?? false;

26}

27/**

28 * @legacy @beta

29 */

30var DataStoreMessageType;

31(function (DataStoreMessageType) {

32 // Creates a new channel

33 DataStoreMessageType["Attach"] = "attach";

34 DataStoreMessageType["ChannelOp"] = "op";

35})(DataStoreMessageType || (exports.DataStoreMessageType = DataStoreMessageType = {}));

36/**

37 * The common URL prefix used by legacy DDS type strings.

38 * Factories originally used full URLs (e.g. `"https://graph.microsoft.com/types/map"`);

39 * new factories use only the trailing path segment (e.g. `"map"`).

40 *

41 * Support for reading both formats was added in 2.92.0.

42 * @remarks

43 * This is encoded using base64 to avoid replacement of URL-like values that we have seen some reverse proxies perform.

44 * The value at runtime is "https://graph.microsoft.com/types/".

45 */

46const legacyTypeUrlPrefix = atob("aHR0cHM6Ly9ncmFwaC5taWNyb3NvZnQuY29tL3R5cGVzLw==");

47/**

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/dataStoreRuntime.jsView on unpkg · L45

48 * Wraps an {@link ISharedObjectRegistry} to transparently redirect legacy URL-based DDS type

49 * strings to the factories registered under the corresponding short-name path segment.

50 *

51 * When a lookup by the full URL fails, this wrapper retries using only the portion of the URL

52 * after `"https://graph.microsoft.com/types/"`. This allows old documents whose summaries

53 * contain URL-based type strings to be loaded against a registry built with the current

54 * short-name factory types.

55 *

56 * @remarks

57 * See {@link legacyTypeUrlPrefix} for details on old vs. new formats

58 */

59class LegacyTypeAwareRegistry {

60 constructor(base) {

61 this.base = base;

62 }

63 get(name) {

64 let factory = this.base.get(name);

65 if (factory !== undefined) {