registry / spark-ssr / 0.5.0

spark-ssr@0.5.0

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. No build

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 164 KB of source

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-34javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

9import { maskComments } from './parse.js';

11const FN_CACHE = new Map();

12function compile(expr) {

13 let fn = FN_CACHE.get(expr);

14 if (!fn) {

15 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

16 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

17 FN_CACHE.set(expr, fn);

18 }

19 return fn;

20}

22// Every identifier resolves through the scope proxy (undefined when absent),

23// with the handful of globals expressions legitimately reach for.

24const GLOBALS = {

25 JSON, Math, Date, Object, Array, String, Number, Boolean,

26 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

27};

28function scopeProxy(scope) {

29 return new Proxy(scope, {

30 has: (t, k) => k !== Symbol.unscopables,

31 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

32 });

33}

34export function evalExpr(expr, scope) {

src/server.jsView file

Lines 381-421javascript

381 }

382 const broadcastSql = (sql) => {

383 const event = /^\s*insert/i.test(sql) ? 'insert'

384 : /^\s*

Source & flagged code

2 flagged · loading source

src/render.jsView file

14if (!fn) { L15: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L16: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

src/server.jsView file

401try { L402: const mod = await import(pathToFileURL(file).href); L403: return typeof mod.default === 'function' ? mod.default : null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L401

Findings

3 Medium4 Low

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

src/render.jsView file

Lines 1-34javascript

1/**

2 * Server-side renderer for Spark templates: {expr} interpolation,

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML in one pass. Event

5 * handlers and bind: attributes are stripped (the hydration component

6 * re-attaches them client-side; static pages don't need them).

7 */

8import { parseHTML } from 'linkedom';

9import { maskComments } from './parse.js';

11const FN_CACHE = new Map();

12function compile(expr) {

13 let fn = FN_CACHE.get(expr);

14 if (!fn) {

15 try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); }

16 catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L14

17 FN_CACHE.set(expr, fn);

18 }

19 return fn;

20}

22// Every identifier resolves through the scope proxy (undefined when absent),

23// with the handful of globals expressions legitimately reach for.

24const GLOBALS = {

25 JSON, Math, Date, Object, Array, String, Number, Boolean,

26 encodeURIComponent, decodeURIComponent, parseInt, parseFloat, isNaN,

27};

28function scopeProxy(scope) {

29 return new Proxy(scope, {

30 has: (t, k) => k !== Symbol.unscopables,

31 get: (t, k) => (k === Symbol.unscopables ? undefined : k in t ? t[k] : GLOBALS[k]),

32 });

33}

34export function evalExpr(expr, scope) {

src/server.jsView file

Lines 381-421javascript

381 }

382 const broadcastSql = (sql) => {

383 const event = /^\s*insert/i.test(sql) ? 'insert'

384 : /^\s*