registry / spark-ssr / 1.2.0

spark-ssr@1.2.0

Zero-config SSR for spark-html on Bun. The HTML template infers everything: filesystem routing, layouts, <spark-ssr> declarative data (SQL, URLs, globs, modules), auto CRUD with validation, guards, no-JS forms, schema + seeds, live updates, SEO. Precompil

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was found. Observed dynamic execution, fetch, filesystem, and process.env use are aligned with a Bun SSR framework and activated by user runtime or CLI commands.

Static reason

One or more suspicious static signals were detected.

Trigger

User imports/runs spark-ssr server or invokes spark-ssr CLI commands.

Impact

No evidence of credential exfiltration, install-time mutation, persistence, destructive behavior outside explicit build output, or remote payload loading.

Mechanism

SSR framework runtime, configured data sources, API handlers, jobs, and build output generation.

Rationale

Static inspection shows scanner hits are expected framework features: user-authored template/API evaluation, configured fetch/mail sources, env-based config, and explicit build/db CLI actions. There are no lifecycle hooks, hardcoded external endpoints, credential harvesting, broad AI-agent control-surface writes, or unconsented install/import-time mutation.

Evidence

package.jsonbin/cli.jssrc/sources.jssrc/routes.jssrc/render.jssrc/jobs.jssrc/crud.jssrc/config.jssrc/static.jsdist/dist/__server.jsdist/Dockerfileproject files under pages/ components/ api/ seed/ content/ lib/ public/

Decision evidence

public snapshot

AI called this Clean at 92.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no npm lifecycle scripts; entrypoints are main ./src/index.js and user-run bin ./bin/cli.js.
bin/cli.js file writes/removes are limited to user project dist/ during explicit build; Bun.spawnSync invokes bun build only for that command.
src/sources.js fetch/import/readFile implement declared SSR URL, glob, and module data sources with root path containment checks.
src/routes.js and src/render.js dynamic Function/AsyncFunction compile project-authored templates, api/*.html, and middleware.html at runtime; no install-time execution.
src/jobs.js webhook fetch and mail module import are driven by spark.json configuration; no hardcoded exfiltration endpoint.
src/crud.js password handling hashes/removes auth-table passwords rather than harvesting secrets.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 233 KB of source

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 415-455javascript

415 const routes = makeRoutes(app);

416 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

417

418 // ── the Spark family, wired in ──

419 // Companion packages the app depends on get an importmap entry and are

420 // served at /@modules/<name>, so client scripts import them bare — the same

Source & flagged code

3 flagged · loading source

src/crud.jsView file

128patternName = generic_password severity = medium line = 128 matchedText = if (!Str...ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

src/render.jsView file

23if (!fn) { L24: try { fn = new Function('__scope__', 'with (__scope__) { return (' + expr + '); }'); } L25: catch { fn = () => undefined; }

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/render.jsView on unpkg · L23

src/server.jsView file

435// Resolve from the APP's root, not this module's own location — a bare L436: // `import('spark-html-theme/init')` would resolve relative to L437: // server.js, which only works when the installer hoists the app's deps

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/server.jsView on unpkg · L435

Findings

4 Medium4 Low

MediumSecret Patternsrc/crud.js

MediumDynamic Requiresrc/server.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalsrc/render.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

src/crud.jsView file

Lines 108-148javascript

108 if (isAuthTable && 'auth' in req.query) return login(req);

109 const { names, scoped } = await tableInfo(table);

110 if (scoped && !req.session) return json({ error: 'unauthorized' }, 401);

111 const { fields } = await req.body();

112 // The markup's constraint attributes are the validation spec (§6).

113 const rules = validators.get(table);

114 if (rules) {

115 const errors = validateFields(rules, fields);

116 if (errors) return json({ errors }, 422);

117 }

118 // The auth table is an identity store, not ordinary CRUD. Its built-in

119 // /signup screen is synthesized (never scanned by extractForms), so its

120 // `required` fields are re-checked here — a row with a null password

121 // could never log in (timingSafeEqual against nothing). And the

122 // identity must be unique: login matches the first row, so a duplicate

123 // would be a dead account with no error explaining why.

124 if (isAuthTable) {

125 const identity = config.auth.identity || 'email';

126 const errors = {};

127 if (!String(fields[identity] ?? '').trim()) errors[identity] = `${identity} is required`;

128 if (!String(fields.password ?? '')) errors.password = 'password is required';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/crud.jsView on unpkg · L128

129 if (Object.keys(errors).length) return json({ errors }, 422);

130 const dup = await db.query(`SELECT id FROM ${table} WHERE ${identity} = ?`, [fields[identity]]);

131 if (dup.length) {

132 return json({ errors: { [identity]: `that ${identity} is already registered — log in instead` } }, 409);

133 }

134 }

135 const data = {};

136 for (const [k, v] of Object.entries(fields)) {

137 if (names.includes(k) && k !== 'id' && k !== 'user_id') data[k] = v;

138 }

139 // Passwords never land in the auth table as plaintext.

140 if (isAuthTable && typeof data.password === 'string') {

141 data.password = await Bun.password.hash(data.password);

142 }

143 if (scoped) data.user_id = req.session.id;

144 const keys = Object.keys(data);

145 if (!keys.length) return json({ error: 'empty body' }, 400);

146 const rows = await db.query(

147 `INSERT INTO ${table} (${keys.join(', ')}) VALUES (${keys.map(() => '?').join(', ')}) RETURNING *`,

148 keys.map((k) => data[k]),

src/render.jsView file

Lines 3-43javascript

3 * <template each/if/else-if/else/await>, :attr dynamics, and <div import>

4 * component composition — rendered to static HTML. Event handlers and bind:

5 * attributes are stripped (the hydration component re-attaches them

6 * client-side; static pages don't need them).

7 *

8 * Precompiled (§1 of ssr-improvements.md): linkedom parses each template

9 * ONCE, at compile time — the parsed DOM is walked into a flat program of

src/server.jsView file

Lines 415-455javascript

415 const routes = makeRoutes(app);

416 const { refreshApi, matchApi, refreshMiddleware, mwState } = routes;

417

418 // ── the Spark family, wired in ──

419 // Companion packages the app depends on get an importmap entry and are

420 // served at /@modules/<name>, so client scripts import them bare — the same