registry / @workday/canvas-kit-docs / 15.0.18

@workday/canvas-kit-docs@15.0.18

Documentation components of Canvas Kit components

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 554 file(s), 1.39 MB of source, external domains: avatars.githubusercontent.com, canvas.workday.com, canvas.workdaydesign.com, design.workday.com, developer.mozilla.org, emotion.sh, esbuild.github.io, github.com, picsum.photos, popper.js.org, reactjs.org, workday.com, workday.github.io, www.theuiaa.org, www.typescriptlang.org, www.w3.org

Oversized source lightweight scan

dist/es6/lib/docs.js15.3 MB file, sampled 256 KB

HighEntropyStringsUrlStringsdeveloper.mozilla.orgemotion.shesbuild.github.iogithub.comreactjs.orgwww.typescriptlang.org

Source & flagged code

4 flagged

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView file

Lines 64-104tsx

64const validationSchema: SchemaOf<LoginSchema> = object({

65 email: string().email('Enter a valid email').required(emailRequired),

66 password: string().min(passwordMinimum, passwordHint).required(passwordRequired),

67 role: string().required(roleRequired),

68});

70const options = [

71 {id: '1', label: 'Developer'},

72 {id: '2', label: 'Designer'},

73 {id: '3', label: 'Product Manager'},

74];

76export default () => {

77 const {

78 handleSubmit,

79 register,

80 formState: {errors},

81 } = useForm<LoginSchema>({

82 defaultValues: {

83 email: 'example@baz.com',

84 password: 'foobarbaz',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView on unpkg · L84

85 role: '',

86 },

87 resolver: useYupValidationResolver(validationSchema),

88 mode: 'onTouched',

89 });

91 const onSubmit = handleSubmit(values => {

92 setShowPassword(false);

93 // Send data to server

94 setTimeout(() => {

95 alert(JSON.stringify(values, null, 2));

96 }, 0);

97 });

99 const [showPassword, setShowPassword] = React.useState(false);

100 const passwordId = useUniqueId();

101 const passwordRef = React.useRef<HTMLInputElement | null>(null);

102 const {ref: passwordCallbackRef, ...passwordRegistration} = register('password');

103 const combinePasswordRef = (ref: HTMLInputElement | null) => {

104 passwordCallbackRef(ref);

dist/es6/utils/parseSpecFile.jsView file

Lines 1-26javascript

1import fs from 'node:fs/promises';

2import path from 'node:path';

3import typescript from 'typescript';

4/**

5 * Reads a spec file by getting the file contents as a string, passing through the TypeScript

6 * transpiler, setting up custom `describe`, `it`, `beforeEach`, etc functions and runs the file

7 * contents through `eval()` with those custom functions to extract out a JSON object representing

dist/es6/lib/Specifications.jsView file

Lines 1-31javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2/* eslint-disable no-param-reassign */

3import { toId } from '@storybook/csf';

4import React from 'react';

5import { Hyperlink } from '@workday/canvas-kit-react/button';

dist/es6/lib/docs.jsView file

•path = dist/es6/lib/docs.js kind = oversized_source_file sizeBytes = 16058520 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/es6/lib/docs.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView file

84patternName = generic_password severity = medium line = 84 matchedText = password...az',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView on unpkg · L84

dist/es6/utils/parseSpecFile.jsView file

6* transpiler, setting up custom `describe`, `it`, `beforeEach`, etc functions and runs the file L7: * contents through `eval()` with those custom functions to extract out a JSON object representing L8: * the structure of a Spec file. We use `eval` instead of an AST parser to handle meta coding like

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/es6/utils/parseSpecFile.jsView on unpkg · L6

dist/es6/lib/Specifications.jsView file

11if (file && !initialSpecs) { L12: import(/* @vite-ignore */ file).then(({ default: contents }) => { L13: setSpecs(contents);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/es6/lib/Specifications.jsView on unpkg · L11

dist/es6/lib/docs.jsView file

•path = dist/es6/lib/docs.js kind = oversized_source_file sizeBytes = 16058520 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/es6/lib/docs.jsView on unpkg

Findings

1 High4 Medium5 Low

HighOversized Source Filedist/es6/lib/docs.js

MediumSecret Patterndist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsx

MediumDynamic Requiredist/es6/lib/Specifications.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/es6/utils/parseSpecFile.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView file

Lines 64-104tsx

64const validationSchema: SchemaOf<LoginSchema> = object({

65 email: string().email('Enter a valid email').required(emailRequired),

66 password: string().min(passwordMinimum, passwordHint).required(passwordRequired),

67 role: string().required(roleRequired),

68});

70const options = [

71 {id: '1', label: 'Developer'},

72 {id: '2', label: 'Designer'},

73 {id: '3', label: 'Product Manager'},

74];

76export default () => {

77 const {

78 handleSubmit,

79 register,

80 formState: {errors},

81 } = useForm<LoginSchema>({

82 defaultValues: {

83 email: 'example@baz.com',

84 password: 'foobarbaz',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mdx/preview-react/_examples/mdx/examples/TextInputWithReactHookForm.tsxView on unpkg · L84

85 role: '',

86 },

87 resolver: useYupValidationResolver(validationSchema),

88 mode: 'onTouched',

89 });

91 const onSubmit = handleSubmit(values => {

92 setShowPassword(false);

93 // Send data to server

94 setTimeout(() => {

95 alert(JSON.stringify(values, null, 2));

96 }, 0);

97 });

99 const [showPassword, setShowPassword] = React.useState(false);

100 const passwordId = useUniqueId();

101 const passwordRef = React.useRef<HTMLInputElement | null>(null);

102 const {ref: passwordCallbackRef, ...passwordRegistration} = register('password');

103 const combinePasswordRef = (ref: HTMLInputElement | null) => {

104 passwordCallbackRef(ref);

dist/es6/utils/parseSpecFile.jsView file

Lines 1-26javascript

1import fs from 'node:fs/promises';

2import path from 'node:path';

3import typescript from 'typescript';

4/**

5 * Reads a spec file by getting the file contents as a string, passing through the TypeScript

6 * transpiler, setting up custom `describe`, `it`, `beforeEach`, etc functions and runs the file

7 * contents through `eval()` with those custom functions to extract out a JSON object representing

dist/es6/lib/Specifications.jsView file

Lines 1-31javascript

1import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";

2/* eslint-disable no-param-reassign */

3import { toId } from '@storybook/csf';

4import React from 'react';

5import { Hyperlink } from '@workday/canvas-kit-react/button';

dist/es6/lib/docs.jsView file

•path = dist/es6/lib/docs.js kind = oversized_source_file sizeBytes = 16058520 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/es6/lib/docs.jsView on unpkg