registry / spark-ssr / 0.3.1

spark-ssr@0.3.1

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. No build

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 130 KB of source, external domains: www.sitemaps.org

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-34javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

9import { maskComments } from './parse.js';

11const FN_CACHE = new Map();

12function compile(expr) {

13 let fn = FN_CACHE.get(expr);

14 if (!fn) {

15 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

16 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

17 FN_CACHE.set(expr, fn);

18 }

19 return fn;

20}

22// Every identifier resolves through the scope proxy (undefined when absent),

23// with the handful of globals expressions legitimately reach for.

24const GLOBALS = {

25 JSON, Math, Date, Object, Array, String, Number, Boolean,

26 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

27};

28function scopeProxy(scope) {

29 return new Proxy(scope, {

30 has: (t, k) => k !== Symbol.unscopables,

31 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

32 });

33}

34export function evalExpr(expr, scope) {

src/server.jsView file

Lines 328-368javascript

328 }

329 }

330 const broadcastSql = (sql) => { for (const t of sqlTables(sql)) broadcast(t); };

331

332 // ── the Spark family, wired in ──

333 // Companion packages the app depends on get an importmap entry and are

Source & flagged code

2 flagged · loading source

src/render.jsView file

14if (!fn) { L15: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L16: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

src/server.jsView file

348try { L349: const { themeInitScript } = await import('spark-html-theme/init'); L350: themeInit = `<script>${themeInitScript()}</script>`;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L348

Findings

3 Medium5 Low

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-34javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

9import { maskComments } from './parse.js';

11const FN_CACHE = new Map();

12function compile(expr) {

13 let fn = FN_CACHE.get(expr);

14 if (!fn) {

15 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

16 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

17 FN_CACHE.set(expr, fn);

18 }

19 return fn;

20}

22// Every identifier resolves through the scope proxy (undefined when absent),

23// with the handful of globals expressions legitimately reach for.

24const GLOBALS = {

25 JSON, Math, Date, Object, Array, String, Number, Boolean,

26 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

27};

28function scopeProxy(scope) {

29 return new Proxy(scope, {

30 has: (t, k) => k !== Symbol.unscopables,

31 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

32 });

33}

34export function evalExpr(expr, scope) {

src/server.jsView file

Lines 328-368javascript

328 }

329 }

330 const broadcastSql = (sql) => { for (const t of sqlTables(sql)) broadcast(t); };

331

332 // ── the Spark family, wired in ──

333 // Companion packages the app depends on get an importmap entry and are