Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one
This report summarizes scanner evidence for oven-sh/bun, a Rust project with 96,480 GitHub stars. SynthScan examined 5,965,907 lines of code across 30290 source files, recording 19765 pattern matches distributed across 25 syntactic categories. The legacy adjusted pattern signal is 6.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 12149 finding(s).
Are imports declared and package/API names verified? 3041 finding(s).
Are wrappers, guards, and repeated structures necessary? 6029 finding(s).
Which changes need focused human review? 19765 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 19765 distinct pattern matches across 25 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | Cargo.toml | 148 | # ─── Release optimization ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http3-client.test.ts | 549 | // ───── streaming uploads (pull-driven request bodies) ───── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http3-client.test.ts | 624 | // ───── bidirectional ───── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 38 | // ─── raw server with full preface control ──────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 112 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 475 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 477 | // ─────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/fetch/fetch-http2-adversarial.test.ts | 588 | // ─── session-key regressions ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/workers/worker-late-completion.test.ts | 47 | // ── thread pool: bun_jsc::Job ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/web/workers/worker-late-completion.test.ts | 166 | // ── thread pool: storage inside a JS-owned object ──────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 180 | // ── HTTP thread ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 190 | // ── bundle thread ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | test/js/web/workers/worker-late-completion.test.ts | 197 | // ── weak posters (no ticket): delivered while draining, or refused ─────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 75 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 77 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 127 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 129 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 153 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 155 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 202 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 204 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 278 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 280 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 328 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/terminal/terminal-platform-gaps.test.ts | 330 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 27 | // this file should be runnable standalone) ──────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 146 | // ─── 1. format confusion / lying magic bytes ───────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 181 | // ─── 2. truncation at every boundary ───────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 310 | // ─── 3. lying / overflowing header fields ──────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 422 | // ─── 4. malformed PNG chunk structure ──────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 490 | // ─── 5. malformed JPEG / EXIF ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 526 | // ─── 5b. JPEG that libjpeg decodes with a warning ──────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 799 | // ─── 5c. lossless JPEG (SOF3) ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 999 | // ─── 6. lossless roundtrip parity ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1063 | // ─── 7. memory hygiene under repetition ────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1118 | // ─── 8. hostile JS option objects ──────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1238 | // ─── 9. concurrency / re-use ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-adversarial.test.ts | 1359 | // ─── 10. random-byte fuzz (cheap, bounded) ─────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 10 | // ─── plumbing (PNG build/read; same shape as image.test.ts) ───────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 105 | // ─── resize filters ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-kernels.test.ts | 228 | // ─── Floyd–Steinberg dither ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 34 | // failure modes; small so the fixture stays a few-hundred KB) ──────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 73 | // ─── PNG plumbing (same hand-roller as the other suites) ──────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image-vs-sharp.test.ts | 165 | // back, in the same iteration order the test uses. ───────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 7 | // ─── Fixture builders ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 157 | // ─── Tests ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 1462 | // ── LZW pack ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/image/image.test.ts | 1510 | // ── container ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 46 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 48 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 74 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 76 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 121 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 123 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 157 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 159 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 191 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 194 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 230 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | test/js/bun/http/proxy-stress-headers.test.ts | 233 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| 4482 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | Cargo.toml | 141 | # heavy dev-dependencies (criterion, html5ever) never enter `Cargo.lock`. | COMMENT |
| LOW | Cargo.toml | 181 | # level as release; binary is large but profilable. | COMMENT |
| LOW | rustfmt.toml | 1 | # rustfmt config for the Cargo workspace. Formatting is the toolchain default | COMMENT |
| LOW | bunfig.toml | 1 | [test] | COMMENT |
| LOW | rust-toolchain.toml | 1 | [toolchain] | COMMENT |
| LOW | bench/snippets/buffer.js | 21 | // time("DataView.getBigInt64 (BE)", () => view.getBigInt64(0, false)); | COMMENT |
| LOW | bench/snippets/buffer.js | 41 | time("Buffer.readFloatLE ", () => buf.readFloatLE(0)); | COMMENT |
| LOW | bench/snippets/buffer.js | 61 | // console.log(""); | COMMENT |
| LOW | bench/snippets/buffer.js | 81 | time("Buffer.writeBigUInt64BE", () => buf.writeBigUInt64BE(BigInt(0), 0)); | COMMENT |
| LOW | bench/snippets/buffer.js | 101 | // console.log(""); | COMMENT |
| LOW | bench/snippets/deep-equals.js | 341 | // get foo() { | COMMENT |
| LOW | bench/install/next-env.d.ts | 1 | /// <reference types="next" /> | COMMENT |
| LOW | test/expectations.txt | 1 | # Format: [modifier] test-name [[ expectations ]] [# comment] | COMMENT |
| LOW | test/expectations.txt | 21 | # agents have no ClangCL toolset ("MSB8020: The build tools for ClangCL cannot | COMMENT |
| LOW | test/flaky-tests.txt | 1 | # Test files known to be flaky in CI. The runner (scripts/runner.node.ts) | COMMENT |
| LOW | test/v8/v8-module/main.cpp | 1 | #include <node.h> | COMMENT |
| LOW | test/snippets/lodash-regexp.js | 21 | // export function test() { | COMMENT |
| LOW | test/docker/coordinator.ts | 41 | COMMENT | |
| LOW | test/js/workerd/html-rewriter-leak.test.ts | 121 | expect(after.protectedException).toBeLessThanOrEqual(before.protectedException); | COMMENT |
| LOW | test/js/workerd/html-rewriter-leak.test.ts | 341 | // LOLHTMLContext.deinit() must destroy those allocations. Previously it only | COMMENT |
| LOW | test/js/web/structured-clone-blob-file.test.ts | 361 | expect(cloned.file).toBeInstanceOf(File); | COMMENT |
| LOW | …/js/web/abort/abort-signal-event-listener-leak.test.ts | 1 | import { estimateShallowMemoryUsageOf } from "bun:jsc"; | COMMENT |
| LOW | test/js/web/websocket/websocket-syscall-fault.test.ts | 341 | test("writev → zero (once) on a ≥16 KB server frame: send() reports backpressure, client receives full payload", async | COMMENT |
| LOW | …bsocket/websocket-proxy-tunnel-upgrade-leak-fixture.ts | 1 | // Repro for HTTPUpgradeClient leak on wss:// through an HTTP CONNECT proxy | COMMENT |
| LOW | …b/websocket/websocket-proxy-tunnel-client-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | …socket/websocket-permessage-deflate-edge-cases.test.ts | 581 | }, | COMMENT |
| LOW | test/js/web/websocket/websocket-utf16-headers.test.ts | 1 | // Regression test for WebSocket upgrade request crash on non-ASCII inputs. | COMMENT |
| LOW | test/js/web/websocket/websocket-proxy.test.ts | 441 | // the first buffer (the automatic pong for a ping, or send() from a message | COMMENT |
| LOW | test/js/web/websocket/websocket.tls.ipv6.test.ts | 1 | // Regression test for the WebSocket side of | COMMENT |
| LOW | …ebsocket/websocket-proxy-tunnel-client-leak-fixture.ts | 1 | // Repro for NewWebSocketClient(false) leak on wss:// through an HTTP CONNECT | COMMENT |
| LOW | test/js/web/intl/intl.test.ts | 1 | // ECMA-402 Intl coverage. Doubles as the regression net for the per-item zstd | COMMENT |
| LOW | test/js/web/timers/timers-fixture-unref.js | 81 | // See https://github.com/nodejs/node/issues/9561 | COMMENT |
| LOW | test/js/web/streams/compression.test.ts | 661 | return source.pulls; | COMMENT |
| LOW | test/js/web/streams/streams-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | test/js/web/streams/native-source-onclose-leak.test.ts | 1 | import { heapStats } from "bun:jsc"; | COMMENT |
| LOW | test/js/web/encoding/text-decoder-cjk.test.ts | 281 | // 8F A1 starts a JIS X 0212 sequence; 0x61 aborts it. A1 A1 is then a | COMMENT |
| LOW | test/js/web/encoding/text-encoder-stream.test.ts | 301 | // Latin-1: the up-front reservation (one byte per input byte) is above the cap. | COMMENT |
| LOW | …t/js/web/html/FormData-multipart-serialization.test.ts | 161 | // Serializing an in-memory blob entry borrows its bytes; the only blob-sized | COMMENT |
| LOW | test/js/web/html/FormData-file-error-leak.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | test/js/web/html/FormData-file-error-leak-fixture.ts | 1 | // Fixture for FormData → multipart body memory leak on readFile failure. | COMMENT |
| LOW | …/js/web/broadcastchannel/message-event-init-gc.test.ts | 1 | import { expect, test } from "bun:test"; | COMMENT |
| LOW | …b/broadcastchannel/broadcast-channel-worker-gc.test.ts | 101 | ); | COMMENT |
| LOW | …b/broadcastchannel/broadcast-channel-worker-gc.test.ts | 181 | expect(filterStderr(stderr)).toBe(""); | COMMENT |
| LOW | test/js/web/fetch/http-chunked-server.c | 1 | // Simple HTTP server that reproduces a streaming response body bug. | COMMENT |
| LOW | test/js/web/fetch/fetch-tcp-keepalive.test.ts | 1 | // Verifies that fetch() enables TCP keepalive (SO_KEEPALIVE + TCP_KEEPIDLE) | COMMENT |
| LOW | test/js/web/fetch/fetch-tcp-keepalive.test.ts | 161 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | test/js/web/fetch/fetch-buffer-peak-fixture.ts | 1 | // Measures the client-side resident set across a single large buffered | COMMENT |
| LOW | …st/js/web/fetch/fetch-proxy-tls-intern-race-fixture.ts | 1 | // Subprocess fixture for fetch-proxy-tls-intern-race.test.ts. | COMMENT |
| LOW | test/js/web/fetch/fetch-connection-header.test.ts | 221 | // On HTTP/1.1, `keepalive: false`, or a FetchSession with `keepAlive: false`, | COMMENT |
| LOW | test/js/web/fetch/fetch-abort-queued.test.ts | 1 | // When `active_requests_count >= max_simultaneous_requests`, new fetch() | COMMENT |
| LOW | test/js/web/fetch/blob.test.ts | 341 | expect([a.name, b.name]).toEqual(["a.txt", "b.txt"]); | COMMENT |
| LOW | test/js/web/fetch/fetch-http3-client.test.ts | 401 | const res = await fetch(`${base}${path}`, { ...h3, method: "POST", body: "x", headers }); | COMMENT |
| LOW | test/js/web/fetch/fetch-http3-client.test.ts | 1061 | COMMENT | |
| LOW | …js/web/fetch/fetch-stream-body-ended-inline-fixture.ts | 1 | // Regression: fetch() with a native ByteStream request body (an upstream | COMMENT |
| LOW | test/js/web/fetch/body.test.ts | 1301 | // by GC in this build independently of bodies — `Buffer.alloc(2e6).toString()` | COMMENT |
| LOW | test/js/web/fetch/body.test.ts | 1401 | COMMENT | |
| LOW | …/js/web/fetch/fetch.tls.cert-mismatch-churn.fixture.ts | 1 | // Fixture for "rejects a trusted cert with a mismatched hostname cleanly under churn". | COMMENT |
| LOW | …/js/web/fetch/fetch.tls.cert-mismatch-churn.fixture.ts | 21 | COMMENT | |
| LOW | test/js/web/fetch/blob-oom.test.ts | 141 | COMMENT | |
| LOW | test/js/web/fetch/bytestream-partial-read-fixture.ts | 1 | // A consumer starts a native body stream and takes one pull view out of it, then hands the | COMMENT |
| 10321 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 87 | # Extract the content and convert to JS array.toString() format | COMMENT |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 104 | # JavaScript Object.toString() returns "[object Object]" | COMMENT |
| HIGH | test/aot/shell/test262.py | 50 | if (negative !== "" && e !== null && typeof e === "object" && e.constructor && e.constructor.name === negative) { pr | CODE |
| HIGH | test/aot/shell/test262.py | 107 | text = text.replace("if (options && options.restore) {\n __defineProperty(obj, name, originalDesc);", "{\ | STRING |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 14 | case("a-prototype-of-a-host-module", 'import { EventEmitter } from "node:events";\nexport const all = (): string => { co | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 15 | 'const { EventEmitter } = require("node:events"); const old = EventEmitter.prototype.emit; const log: string[] = [] | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 17 | 'const seen: string[] = []; const old = console.log; real(attempt(() => { console.log = (...a: unknown[]) => { seen | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 19 | 'const seen: string[] = []; for (const k of ["error", "warn", "info", "debug"]) console[k] = (...a: unknown[]) => { | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 21 | 'const seen: string[] = []; real(attempt(() => { globalThis.console = { log: (...a: unknown[]) => { seen.push(a.joi | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 23 | 'const seen: string[] = []; const old = process.stdout.write; process.stdout.write = (s: string) => { seen.push(s); | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 27 | 'const seen: string[] = []; const olds = [globalThis.setTimeout, globalThis.setImmediate, globalThis.queueMicrotask | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 41 | case("process-exit", 'export const all = (): void => { process.exit(3); console.log("behind exit"); };', 'const seen: un | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 47 | case("undefined-nan-infinity-and-globalthis", 'export const all = (): string => [undefined, NaN, Infinity, typeof global | CODE |
| HIGH⚡ | test/aot/fuzz/made/runtime-patching-tools.py | 50 | case("a-symbol-keyed-global", 'const KEY = Symbol.for("my.registry");\nexport const all = (): string => JSON.stringify(g | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 7 | H = """const show = v => { try { return typeof v === 'string' ? JSON.stringify(v.length > 40 ? v.slice(0, 20) + '..' + v | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 7 | H = """const show = v => { try { return typeof v === 'string' ? JSON.stringify(v.length > 40 ? v.slice(0, 20) + '..' + v | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 11 | class K {} function F() {} const bound = F.bind(null), arrow = () => 1, proxyObject = new Proxy({}, {}), proxyFunction = | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 12 | const values = { undefined: undefined, null: null, true: true, false: false, zero: 0, minusZero: -0, one: 1, minusOne: - | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 15 | object: {}, array: [], arrayOne: [1], fn: F, klass: K, bound, arrow, proxyObject, proxyFunction, revoked, date: new Da | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 53 | line('not two strings', () => J('a', 1), () => J(1, 'a'), () => J(1, 2), () => J(0.5, 'x'), () => J('x', -0), () => J( | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 55 | line('json', () => json[f]({ id: 1, name: 'n' }), () => json[f]({ id: 1.5, name: '\\u0416' }), () => json[f]({ id: nul | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 62 | line('a miss, then it is there', () => { const o = { x: 1 }; const before = hot(miss[f], o); o.absent = 'own'; return | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 63 | line('a miss of odd receivers', () => hot(miss[f], new Proxy({}, { get: (t, k) => 'trap ' + k })), () => hot(miss[f], | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 64 | line('defaults', () => hot(destructure[f], {}), () => hot(destructure[f], { a: 1 }), () => hot(destructure[f], { absen | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 65 | line('native accessors', () => hot(size[f], new Map([[1, 1]])), () => hot(size[f], new Set()), () => { const m = new M | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 73 | line('made', () => hot(empty[f]), () => hot(one[f], 1), () => hot(six[f], 'v'), () => Object.keys(hot(many[f], 0)).len | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 74 | line('each is new', () => empty[f]() !== empty[f](), () => { const a = one[f](1), b = one[f](1); a.a = 2; return b.a; | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 74 | line('each is new', () => empty[f]() !== empty[f](), () => { const a = one[f](1), b = one[f](1); a.a = 2; return b.a; | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 75 | line('stored to', () => hot(put[f], {}, 1), () => hot(put[f], { x: 0 }, 1), () => hot(putTwo[f], {}, 1), () => Object. | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 75 | line('stored to', () => hot(put[f], {}, 1), () => hot(put[f], { x: 0 }, 1), () => hot(putTwo[f], {}, 1), () => Object. | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 76 | line('a setter laid later', () => { const p = {}, mk = () => Object.create(p); for (let i = 0; i < 60; i++) put[f](mk( | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 106 | for (const v of [undefined, null, NaN, Infinity, -Infinity, 0, '', 'undefined']) console.log('compare', show(v), say(() | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 113 | line('found, then gone', () => { const o = { a: 1 }; const before = hot(hasA[f], o); delete o.a; return before + ',' + | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 114 | line('missing, then there', () => { const o = {}; const before = hot(hasA[f], o); o.a = undefined; return before + ',' | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 115 | line('receivers', () => hot(hasA[f], new Proxy({}, { has: () => true })), () => hot(hasA[f], new Proxy({ a: 1 }, { has | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 116 | line('keys', () => hot(hasK[f], 'a', { a: 1 }), () => hot(hasK[f], 'length', []), () => hot(hasK[f], 'length', 'x'), ( | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 117 | line('arrays', () => hot(emptyArray[f]), () => emptyArray[f]() !== emptyArray[f](), () => { const a = emptyArray[f](), | CODE |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 24 | "ifTrue": "if (v) return 1; return 0;", "ifNot": "if (!v) return 1; return 0;", "ternary": "return v ? 'y' : 'n';", | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 24 | "ifTrue": "if (v) return 1; return 0;", "ifNot": "if (!v) return 1; return 0;", "ternary": "return v ? 'y' : 'n';", | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 25 | "typeofObject": "return typeof v == 'object';", "typeofObjectStrict": "return typeof v === 'object';", "typeofFuncti | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 26 | "isUndefined": "return v === undefined;", "isNotUndefined": "return v !== undefined;", "isNull": "return v === null; | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 43 | s += """for (const k in binary) { let differ = [], line = ''; for (const x of names) { let row = ''; for (const y of nam | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 80 | # undefined, NaN, Infinity are constants where nothing stands in front of the globals . what `in` found is remembered . | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 82 | "plain": ([], "return [undefined, NaN, Infinity, -Infinity, typeof undefined, NaN !== NaN, 1 / Infinity];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 83 | "parameter": (["undefined", "NaN", "Infinity"], "return [undefined, NaN, Infinity];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 84 | "varInside": ([], "var undefined = 1, NaN = 2, Infinity = 3; return [undefined, NaN, Infinity];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 85 | "letInside": ([], "let undefined = 'u'; { let NaN = 'n'; const Infinity = 'i'; return [undefined, NaN, Infinity]; }" | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 86 | "hoisted": ([], "const before = [undefined, NaN]; var undefined, NaN; undefined = 5; return [before, undefined, NaN] | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 87 | "aNamedFunction": ([], "function NaN() { return 'f'; } return [typeof NaN, typeof undefined];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 88 | "caught": ([], "try { throw 7; } catch (undefined) { return [undefined, typeof NaN]; }"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 89 | "destructured": ([], "const { undefined, NaN = 'd' } = { undefined: 'own' }; return [undefined, NaN];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 90 | "closure": ([], "var undefined = 'outer'; return (function () { return [undefined, (() => undefined)()]; })();"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 91 | "innerParameter": ([], "return [1, 2].map(function (undefined, Infinity) { return [undefined, Infinity]; });"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 93 | "evalDeclares": ([], "eval('var undefined = \\'by eval\\'; var NaN = 1'); return [undefined, NaN];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 94 | "storeSloppy": ([], "undefined = 1; NaN = 2; Infinity = 3; return [undefined, NaN, Infinity];"), | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 96 | "compare": (["v"], "return [v === undefined, v == undefined, v !== undefined, v === NaN, v === Infinity, v < Infinit | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 98 | "asKeys": ([], "const o = { undefined: 1, NaN: 2, Infinity: 3 }; return [o[undefined], o[NaN], o[Infinity], o.undefi | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 99 | "globalThisSays": ([], "return [globalThis.undefined, Object.getOwnPropertyDescriptor(globalThis, 'NaN').writable, ' | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 105 | s += """for (const k in all) { const args = k === 'parameter' ? ['p1', 'p2', 'p3'] : k === 'compare' ? [undefined] : []; | STRING |
| HIGH⚡ | test/aot/fuzz/made/operations-in-runtime-code.py | 110 | cases["in-remembered-and-arrays-made"] = {"main.js": H + both("hasA", ["o"], "return 'a' in o;") + both("hasK", ["k", "o | STRING |
| 1557 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 228 | print("Hello, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 229 | print("Goodbye, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 233 | print("Hello, world!"); | CODE |
| HIGH⚡ | test/js/bun/test/printing/diffexample.fixture.ts | 234 | print("Goodbye, world!"); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 116 | print({ defaultIsExportsObject: ns.default === fs, readFileSync: typeof readFileSync, kinds: kinds() }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 125 | print({ kinds: kinds(), isTheClass: typeof ReadStream === "function" && ReadStream === fs.ReadStream }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 139 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 164 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 182 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 220 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 266 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 300 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 355 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 395 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 436 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 498 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 531 | print({ addedBeforeLoad: ns.addedBeforeLoad, exportsAddedAfterLoad: "addedAfterLoad" in ns }); | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 547 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 583 | print({ | CODE |
| HIGH | test/js/bun/resolve/builtin-esm-lazy-exports.test.ts | 631 | print({ log, e, x }); | CODE |
| HIGH | test/js/bun/shell/bunshell.test.ts | 2552 | elif echo baz;then echo qux;fi` | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 66 | print({ url: view.url, title: view.title, value, undef }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 82 | print({ length: value.length, equal: value === big }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 93 | print(await view.evaluate(JSON.stringify(big) + " === " + ${JSON.stringify(BIG)})); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 105 | print({ type: blob.type, size: bytes.length, hash: String(Bun.hash(bytes)) }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 120 | print({ urls: views.map(view => view.url), values }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 133 | print(await outcome(view.evaluate("(() => { throw new Error('inside the fake'); })()"))); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 156 | print({ death, second: await second.evaluate("'alive again'") }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 175 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 194 | print({ heldOutcome, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 223 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 248 | print({ held, failedMessage: failed.message, loadingAfterFail, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 270 | print({ held, failedMessage, loadingAfterFail }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 300 | print({ failedMessage: failed.message, loadingAfterFail, unhandled }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 327 | print(unhandled); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 355 | print(outcomeStr); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 372 | print({ held, loadingAfterFail }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 387 | print({ url: view.url, value: await view.evaluate("6 * 7") }); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 400 | print(await view.evaluate("__fake_mouse_events()")); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 418 | print(await outcome(view.click("#target", { timeout: 100 }))); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 486 | print(await outcome(view.evaluate("__fake_close_replies()"))); | CODE |
| HIGH | test/js/bun/webview/webview-chrome-pipe.test.ts | 497 | print({ closing, next }); | CODE |
| HIGH | test/js/node/http2/http2-option-checks.fixture.js | 148 | print( | CODE |
| HIGH | test/js/node/http2/http2-option-checks.fixture.js | 164 | print("other calls", [ | CODE |
| HIGH | test/js/node/http/probes/probe.ts | 101 | print() { | CODE |
| HIGH | test/cli/lint/oxc-names.test.ts | 1955 | print(line, (expected, file, code) => { | CODE |
| HIGH | test/cli/lint/bun-rules.test.ts | 3281 | print({ "a.test.js": only }), | CODE |
| HIGH | test/cli/lint/bun-rules.test.ts | 3282 | print({ ".oxlintrc.json": oxlintrc({ [name]: "error" }), "a.test.js": only }), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8723 | print({}, "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8724 | print({}, "--stdin-filepath", "sub/node_modules/y/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8725 | print({}, "--stdin-filepath", "../node_modules/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8726 | print({}, "--check", "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8727 | print({}, "-l", "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8728 | print({}, "--stdin-filepath", "my_node_modules/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8729 | print({}, "--stdin-filepath", ".git/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8730 | print({}, "--with-node-modules", "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8731 | print({ "bunfig.toml": "[fmt]\nwithNodeModules = true\n" }, "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8732 | print({ ".oxfmtrc.json": "{}" }, "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH⚡ | test/cli/format/format.test.ts | 8733 | print({}, "--flavor=oxfmt", "--stdin-filepath", "node_modules/x/a.js"), | CODE |
| HIGH | test/bundler/bundler_jsx.test.ts | 153 | print(<div>Hello World</div>) | CODE |
| 1115 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/harness.ts | 276 | async function findOrDownloadAbiMatchingNode(): Promise<string> { | CODE |
| LOW | test/harness.ts | 606 | export function makeTreeSyncFromDirectoryTree(base: string, tree: DirectoryTree) { | CODE |
| LOW | test/harness.ts | 875 | export function randomInvalidSurrogatePair() { | CODE |
| LOW | test/harness.ts | 1573 | function failTestsOnBlockingWriteCall() { | CODE |
| LOW | test/harness.ts | 2049 | export function fileDescriptorLeakChecker() { | CODE |
| LOW | test/harness.ts | 2553 | async function compileDtUnknownReaddirShim(): Promise<string> { | CODE |
| LOW | test/_util/numeric.ts | 93 | export function computePearsonCorrelation(xs: number[], ys: number[]): number { | CODE |
| LOW | test/_util/numeric.ts | 160 | export function computeAverageAbsoluteDeviation(xs: number[]): number { | CODE |
| LOW | test/js/deno/crypto/random.test.ts | 51 | test(function getRandomValuesReturnValue() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 506 | test(async function subtleCryptoHmacImportExport() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 755 | test(async function testHkdfDeriveBitsWithLargeKeySize() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 768 | test(async function testEcdhDeriveBitsWithShorterLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 782 | test(async function testEcdhDeriveBitsWithLongerLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 795 | test(async function testEcdhDeriveBitsWithNullLength() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 1063 | test(async function testDecryptWithInvalidIntializationVector() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 2559 | test(async function ecPrivateKeyMaterialExportSpki() { | CODE |
| LOW | test/js/deno/crypto/webcrypto.test.ts | 2603 | test(async function testImportLeadingZeroesKey() { | CODE |
| LOW | test/js/deno/abort/abort-controller.test.ts | 52 | test(function controllerHasProperToString() { | CODE |
| LOW | test/js/deno/encoding/encoding.test.ts | 285 | test(function toStringShouldBeWebCompatibility() { | CODE |
| LOW | test/js/deno/encoding/encoding.test.ts | 291 | test(function textEncoderShouldCoerceToString() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 6 | test(function urlSearchParamsWithMultipleSpaces() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 13 | test(function urlSearchParamsWithExclamation() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 23 | test(function urlSearchParamsWithQuotes() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 33 | test(function urlSearchParamsWithBraket() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 53 | test(function urlSearchParamsInitString() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 58 | test(function urlSearchParamsInitStringWithPlusCharacter() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 66 | test(function urlSearchParamsInitStringWithMalformedParams() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 114 | test(function urlSearchParamsAppendSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 119 | test(function urlSearchParamsDeleteSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 125 | test(function urlSearchParamsGetAllSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 137 | test(function urlSearchParamsGetSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 144 | test(function urlSearchParamsHasSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 151 | test(function urlSearchParamsSetReplaceFirstAndRemoveOthers() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 157 | test(function urlSearchParamsSetAppendNew() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 163 | test(function urlSearchParamsSortSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 169 | test(function urlSearchParamsForEachSuccess() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 190 | test(function urlSearchParamsMissingName() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 196 | test(function urlSearchParamsMissingValue() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 202 | test(function urlSearchParamsMissingEqualSign() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 208 | test(function urlSearchParamsMissingPair() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 213 | test(function urlSearchParamsForShortEncodedChar() { | CODE |
| LOW⚡ | test/js/deno/url/urlsearchparams.test.ts | 221 | test(function urlSearchParamsShouldThrowTypeError() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 86 | test(function urlSearchParamsInitIterable() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 100 | test(function urlSearchParamsInitRecord() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 256 | test(function urlSearchParamsAppendArgumentsCheck() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 299 | test(function urlSearchParamsDeletingAppendedMultiple() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 311 | test(function urlSearchParamsCustomSymbolIterator() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 322 | test(function urlSearchParamsCustomSymbolIteratorWithNonStringParams() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 333 | test(function urlSearchParamsOverridingAppendNotChangeConstructorAndSet() { | CODE |
| LOW | test/js/deno/url/urlsearchparams.test.ts | 354 | test(function urlSearchParamsOverridingEntriesNotChangeForEach() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 266 | test(function deletingAllParamsRemovesQuestionMarkFromURL() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 273 | test(function removingNonExistentParamRemovesQuestionMarkFromURL() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 280 | test(function sortingNonExistentParamRemovesQuestionMarkFromURL() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 293 | test(function throwForInvalidPortConstructor() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 307 | test(function doNotOverridePortIfInvalid() { | CODE |
| LOW | test/js/deno/url/url.test.ts | 313 | test(function emptyPortForSchemeDefaultPort() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 332 | test(function assigningPortPropertyAffectsReceiverOnly() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 339 | test(function urlSearchParamsIdentityPreserved() { | CODE |
| LOW⚡ | test/js/deno/url/url.test.ts | 346 | test(function urlTakeURLObjectAsParameter() { | CODE |
| LOW | test/js/deno/fetch/blob.test.ts | 111 | test(function blobConstructorNameIsBlob() { | CODE |
| 1391 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | test/cli/lint/config-files.test.ts | 816 | if (context.sourceCode.scopeManager.globalScope.set.get("Symbol").defs.length > 0) context.report({ node, message: " | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 223 | "input": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 224 | "prettier": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n argumentN | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 225 | "oxfmt": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n argumentNumb | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 709 | "input": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 710 | "prettier": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 711 | "oxfmt": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1183 | "input": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1184 | "prettier": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n argumentN | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1185 | "oxfmt": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n argumentNumb | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1610 | "input": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1611 | "prettier": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n a | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1612 | "oxfmt": "{veryLongFunctionName(\n argumentNumberOne,\n argumentNumberTwo,\n argumentNumberThree,\n argu | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1994 | "input": "{veryLongFunctionName(argumentNumberOne, argumentNumberTwo, argumentNumberThree, argumentNumberFour)}\n<p> | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1995 | "prettier": "{veryLongFunctionName(\r\n argumentNumberOne,\r\n argumentNumberTwo,\r\n argumentNumberThree,\r\n a | CODE |
| CRITICAL⚡ | test/cli/format/svelte/cases.json | 1996 | "oxfmt": "{veryLongFunctionName(\r\n argumentNumberOne,\r\n argumentNumberTwo,\r\n argumentNumberThree,\r\n argu | CODE |
| CRITICAL | …mpiler-fixtures/readonly-object-method-calls.expect.md | 16 | const posts = user.timeline.posts.edges.nodes.map(node => ( | CODE |
| CRITICAL | …mpiler-fixtures/readonly-object-method-calls.expect.md | 45 | posts = user.timeline.posts.edges.nodes.map(_temp); | CODE |
| CRITICAL | …/readonly-object-method-calls-mutable-lambda.expect.md | 17 | const posts = user.timeline.posts.edges.nodes.map(node => { | CODE |
| CRITICAL | …/readonly-object-method-calls-mutable-lambda.expect.md | 46 | const posts = user.timeline.posts.edges.nodes.map((node) => { | CODE |
| CRITICAL | …ixtures/readonly-object-method-calls-mutable-lambda.js | 13 | const posts = user.timeline.posts.edges.nodes.map(node => { | CODE |
| CRITICAL | …eact-compiler-fixtures/readonly-object-method-calls.js | 12 | const posts = user.timeline.posts.edges.nodes.map(node => ( | CODE |
| CRITICAL | …el/external-data/typed-parse-program-evaluates-text.ts | 141 | for (const item of value.list) found += item.kid.kid.kid.f0.charCodeAt(14) + lastOf(item.kid.kid.kid).length; | CODE |
| CRITICAL | test/aot/ir/lower/calls/callee-name.ts | 103 | o.aaaaaaaaaaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbb.cccccccccccccccccccc.dddddddddddddddddddd.m(); | CODE |
| CRITICAL | test/aot/generate/data-from-outside.ts | 536 | for (const item of value.list) found += item.kid.kid.kid.f0.charCodeAt(14) + lastOf(item.kid.kid.kid).length; | CODE |
| CRITICAL | src/lint/context.rs | 257 | *self.base.file.sink.thrown.borrow_mut() = Some(Thrown { | COMMENT |
| CRITICAL | src/lint/context.rs | 268 | let thrown = self.base.file.sink.thrown.borrow(); | CODE |
| CRITICAL | src/lint/code_path/mod.rs | 320 | read(&self.file.lazy.code_paths.paths.borrow()[self.id as usize]) | CODE |
| CRITICAL | src/lint/code_path/mod.rs | 360 | let segments = self.file.lazy.code_paths.segments.borrow(); | CODE |
| CRITICAL | src/lint/code_path/mod.rs | 548 | read(&self.file.lazy.code_paths.segments.borrow()[self.id as usize]) | CODE |
| CRITICAL | src/install/PackageManager/runTasks.rs | 1315 | task.request.local_tarball.tarball.url.slice() | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 159 | let string_buf = self.manager.lockfile.buffers.string_bytes.as_slice(); | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 184 | let string_buf = self.manager.lockfile.buffers.string_bytes.as_slice(); | CODE |
| CRITICAL | src/install/PackageManager/security_scanner.rs | 529 | let resolutions = self.manager.lockfile.buffers.resolutions.as_slice(); | CODE |
| CRITICAL | src/runtime/code_resolver_testing.rs | 332 | let tsconfig_override = vm.transpiler.resolver.opts.tsconfig_override.as_deref(); | CODE |
| CRITICAL | src/runtime/cli/test_command.rs | 1348 | let report = this.jest.test_options.reporters.junit.then(|| { | CODE |
| CRITICAL | src/runtime/api/JSTranspiler.rs | 331 | let Ok(Some(json)) = vm.transpiler.resolver.caches.json.parse_json( | CODE |
| CRITICAL | src/runtime/api/BunObject.bind.ts | 150 | path: b.string.loose.utf8.nullable.default(""), | CODE |
| CRITICAL | src/runtime/api/BunObject.bind.ts | 216 | command: b.string.loose.utf8.nullable.default(""), | CODE |
| CRITICAL | src/sema/program/code_walk.rs | 541 | .map(|file| file.loaded.parse.hir.exprs.len()) | CODE |
| CRITICAL | src/sema/program/code_file/tests/analysis.rs | 283 | assert!(parsed.code.analyzed.analysis.import_sites.is_empty()); | CODE |
| CRITICAL | src/sema/program/code_file/tests/analysis.rs | 357 | match parsed.code.analyzed.analysis.decisions.decision(read) { | CODE |
| CRITICAL | src/sema/program/code_file/tests/analysis.rs | 386 | let decision = parsed.code.analyzed.analysis.decisions.decision(value); | CODE |
| CRITICAL | src/sema/program/code_file/tests/import_sites.rs | 384 | assert!(parsed.code.analyzed.analysis.import_sites.is_empty()); | CODE |
| CRITICAL | src/sema/check/errors.rs | 1759 | let types = self.p.files.options.types.as_ref(); | CODE |
| CRITICAL | src/js_parser/visit/visit_stmt.rs | 1229 | let new_len = if !(data.is_export && p.options.features.replace_exports.entries.len() > 0) { | CODE |
| CRITICAL | src/bundler/bundle_v2.rs | 4664 | let opens_output_paths = !self.transpiler.resolver.opts.output_dir.is_empty() | CODE |
| CRITICAL | src/aot/load/host.rs | 510 | let mut entry_texts = self.input.options.load.entry_texts.iter(); | CODE |
| CRITICAL | src/aot/compile/lower_stage.rs | 375 | application: bound.projects.application.left_out.functions.clone(), | CODE |
| CRITICAL | src/aot/compile/lower_stage.rs | 752 | left_out_declarations: bound.projects.runtime.left_out.declarations.clone(), | CODE |
| CRITICAL | src/aot/lower/data.rs | 23 | if let Some(&data) = self.file.modules.data.records.get(&expression) { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | bench/snippets/buffer-includes.js | 2 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | bench/snippets/buffer-includes.js | 2 | "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna a | CODE |
| LOW | bench/snippets/_fixture.txt | 1191 | <td id="LC98" class="blob-code blob-code-inner js-file-line"><span class="pl-s"> Lorem ipsum dolor sit amet, | CODE |
| LOW | bench/snippets/_fixture.txt | 1191 | <td id="LC98" class="blob-code blob-code-inner js-file-line"><span class="pl-s"> Lorem ipsum dolor sit amet, | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1339 | <td id="LC135" class="blob-code blob-code-inner js-file-line"> let string_long_escaped = "\n Lorem ip | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1339 | <td id="LC135" class="blob-code blob-code-inner js-file-line"> let string_long_escaped = "\n Lorem ip | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1343 | <td id="LC136" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> string_short <sp | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1343 | <td id="LC136" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> string_short <sp | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1351 | <td id="LC138" class="blob-code blob-code-inner js-file-line"> <span class="pl-s">"Lorem ipsum dolor | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1351 | <td id="LC138" class="blob-code blob-code-inner js-file-line"> <span class="pl-s">"Lorem ipsum dolor | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1355 | <td id="LC139" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> no_escape <span | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1355 | <td id="LC139" class="blob-code blob-code-inner js-file-line"> <span class="pl-k">let</span> no_escape <span | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1363 | <td id="LC141" class="blob-code blob-code-inner js-file-line"><span class="pl-s">Lorem ipsum dolor sit amet, con | CODE |
| LOW⚡ | bench/snippets/_fixture.txt | 1363 | <td id="LC141" class="blob-code blob-code-inner js-file-line"><span class="pl-s">Lorem ipsum dolor sit amet, con | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 1991 | .transform(new Response("<p>Lorem ipsum!</p>")) | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 2006 | .transform(new Response("<p>Lorem ipsum!<br></p><div />")) | CODE |
| LOW | test/js/workerd/html-rewriter.test.js | 2024 | .transform(new Response("<p>Lorem ipsum!<br></p><div /><svg><circle /></svg>")) | CODE |
| LOW | test/js/web/streams/compression.test.ts | 1309 | text += `<section id="s${i}"><p>${rand().toString(36).slice(2)} lorem ipsum ${((i * 2654435761) >>> 0).toString(36)} | CODE |
| LOW | test/js/web/fetch/fetch-backpressure.test.ts | 865 | const raw = Buffer.alloc(SIZE, "alpha beta gamma delta lorem ipsum "); | CODE |
| LOW | test/js/valkey/integration/complex-operations.test.ts | 191 | await ctx.redis.set(`${baseKey}:name`, "John Doe"); | CODE |
| LOW | test/js/valkey/integration/complex-operations.test.ts | 219 | expect(nameValue).toBe("John Doe"); | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4206 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4206 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4208 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/expect.test.js | 4208 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 654 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 654 | expect(`Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a n | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 656 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW⚡ | test/js/bun/test/jest-extended.test.js | 656 | `Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec nec posuere felis. Aliquam tincidunt elit a nunc h | CODE |
| LOW | test/js/bun/test/fake-timers/sinonjs/issue-437.test.ts | 18 | return "Lorem ipsum"; | CODE |
| LOW | test/js/bun/test/fake-timers/sinonjs/issue-437.test.ts | 25 | assert.equals(dateTime.foo(), "Lorem ipsum"); | CODE |
| LOW | test/js/bun/io/bun-write.test.js | 286 | "existing.bin": "placeholder", | CODE |
| LOW | test/js/bun/http/bun-serve-routes.test.ts | 60 | id: "user@example.com", | CODE |
| LOW | test/js/bun/http/decodeURIComponentSIMD.test.ts | 21 | "user@example.com", | CODE |
| LOW | test/js/bun/http/serve-http3.test.ts | 2108 | "user@example.com", | CODE |
| LOW | test/js/bun/http/serve-http3.test.ts | 2124 | "user@example.com": "200 /index", | CODE |
| LOW | test/js/bun/http/proxy.test.ts | 2877 | () => ({ HTTP_PROXY: "placeholder" }), | CODE |
| LOW | test/js/bun/http/request-smuggling.test.ts | 1712 | ["user@example.com"], | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 142 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 142 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 149 | <p>Lorem ipsum dolor sit amet.</p> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 149 | <p>Lorem ipsum dolor sit amet.</p> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 170 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 170 | Lorem ipsum dolor sit amet. | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 180 | <tr><td>Lorem ipsum dolor sit amet.</td><td></td></tr> | CODE |
| LOW⚡ | test/js/bun/md/spec-tables.txt | 180 | <tr><td>Lorem ipsum dolor sit amet.</td><td></td></tr> | CODE |
| LOW | test/js/bun/md/spec.txt | 9453 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9512 | > Lorem ipsum dolor | CODE |
| LOW | test/js/bun/md/spec.txt | 9527 | > Lorem ipsum dolor | CODE |
| LOW | test/js/bun/md/spec.txt | 9539 | "Lorem ipsum dolor" | CODE |
| LOW | test/js/bun/md/spec.txt | 9555 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9573 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9595 | "Lorem ipsum dolor\nsit amet." | CODE |
| LOW | test/js/bun/md/spec.txt | 9618 | str "Lorem ipsum dolor" | CODE |
| LOW | test/js/third_party/next-auth/fixture/src/auth.ts | 44 | if (credentials?.email === "user@example.com" && credentials?.password === "password") { | CODE |
| LOW | test/js/third_party/next-auth/fixture/src/auth.ts | 47 | email: "user@example.com", | CODE |
| LOW | …ird_party/body-parser/express-body-parser-test.test.ts | 82 | expect(req.body).toEqual({ "name": "John Doe", "email": "john.doe@example.com" }); | CODE |
| LOW | …ird_party/body-parser/express-body-parser-test.test.ts | 89 | const payload = Buffer.from(JSON.stringify({ "name": "John Doe", "email": "john.doe@example.com" })); | CODE |
| LOW | test/js/third_party/astro/astro-post.test.js | 74 | formData.append("name", "John Doe"); | CODE |
| LOW | test/js/third_party/astro/astro-post.test.js | 87 | name: "John Doe", | CODE |
| 109 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/net/tls-low-prio-queue-fixture.ts | 363 | // Step 2: every ClientHello becomes readable in the next iteration. | COMMENT |
| LOW | …est/parallel/test-http-agent-free-socket-data-guard.js | 31 | // Step 1: Send request1 | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 55 | // Step 2: Server injects a poisoned response while socket is idle | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 64 | // Step 3: Allow the event loop to poll I/O so the guard can fire. | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 73 | // Step 4: Send request2 — should get a fresh connection | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 417 | // Step 4: convert V with ECMA-262 ToNumber. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 420 | // Step 5: normalize -0 to +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 425 | // Step 6: [EnforceRange] rejects non-finite and out-of-range values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 447 | // Step 7: [Clamp] clamps, rounds, and returns non-NaN values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 455 | // Step 8: NaN, +0, -0, and infinities become +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 460 | // Step 9: truncate to IntegerPart(x). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 483 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 488 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 505 | // Step 10: reduce modulo 2^bitLength. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 509 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 514 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 636 | // Step 2: throw unless S is one of the enumeration values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 643 | // Step 3: return the matching enumeration value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 713 | // Step 1: reject non-object, non-null, non-undefined values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 721 | // Step 2: create the IDL dictionary value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 782 | // Step 2: GetMethod(V, %Symbol.iterator%). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 784 | // Step 3: throw if the iterator method is undefined, null, or not callable. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 559 | // Step 2: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 762 | // Step 5: return the IDL dictionary. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 839 | // Step 2: otherwise throw. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 881 | // Step 3: reject non-fixed SharedArrayBuffer backing stores unless | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 950 | // Step 5: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 1016 | // Step 4: return a reference to the same ArrayBuffer. | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 660 | // Step 1: Insert a row (succeeds) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 666 | // Step 2: Try to insert conflicting row (throws expected error) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 675 | // Step 3: Try another query - THIS WILL HANG | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 25 | // Step 1: Check if stdin is piped | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 34 | // Step 2: After stdin EOF, try to reopen /dev/tty | COMMENT |
| LOW | test/bundler/bundler_compile.test.ts | 1492 | // Step 2: Run bun build with compile, minify, sourcemap, and bytecode | COMMENT |
| LOW | packages/bun-uws/src/HttpContext.h | 600 | /* First of all we need to check if this socket was deleted due to upgrade */ | COMMENT |
| LOW | packages/bun-uws/src/HttpContext.h | 842 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | packages/bun-uws/src/HttpResponse.h | 295 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | packages/bun-uws/src/HttpResponse.h | 353 | /* We need to check if we should close this socket here now */ | COMMENT |
| LOW | src/install/npm.rs | 1976 | // stability check - if the previous package is blocked from age, we need to check if the current packag | COMMENT |
| LOW | src/install/npm.rs | 2188 | // stability check - if the previous package is blocked from age, we need to check if the current package wa | COMMENT |
| LOW | src/js/internal/streams/readable.ts | 1107 | // We need to check if there is someone still listening to | COMMENT |
| LOW | src/js/internal/streams/readable.ts | 1129 | // We need to check if there is someone still listening to | COMMENT |
| LOW | src/js/internal/repl/completion.ts | 735 | // If a getter/proxy hasn't been found by the recursion call we need to check if maybe a getter/proxy | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 115 | // Step 1: Merge affected scopes to their canonical root. | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 166 | // Step 2: Repoint identifiers whose scopes were merged | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 266 | // Step 1: Collect rewrites | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 269 | // Step 2: Apply rewrites by splitting blocks | COMMENT |
| LOW | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 328 | // Step 3: Repoint phis when they refer to a rewritten block | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 348 | // Step 4: Fixup HIR to restore RPO, correct predecessors, renumber instructions | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 353 | // Step 5: Fix scope and identifier ranges to account for renumbered instructions | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 100 | // Step 2: Calculate hoistable dependencies using the tree. | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 110 | // Step 3: Reduce dependencies to a minimal set. | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1112 | // Step 1: Collect identifier to function expression mappings | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1140 | // Step 2: Forward pass to analyze assumed function calls | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1213 | // Step 3: Propagate assumed-invoked status through mayInvoke chains | COMMENT |
| LOW | src/runtime/server/StaticRoute.rs | 505 | // Step 1: If-Match (strong comparison); step 2: If-Unmodified-Since | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 522 | // Step 3: If-None-Match (weak comparison). Presence suppresses step 4. | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 528 | // Step 4: If-Modified-Since (only when If-None-Match is absent). | COMMENT |
| LOW | src/runtime/api/bun/js_bun_spawn_bindings.rs | 361 | // Since the event loop is recursively called, we need to check if it's safe to recurse. | COMMENT |
| LOW | src/runtime/webcore/Body.rs | 1809 | // Step 1: If this is unusable, throw a TypeError. | COMMENT |
| 15 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 16 | var iC=Object.create;var{getPrototypeOf:tC,defineProperty:XE,getOwnPropertyNames:JC}=Object;var VC=Object.prototype.hasO | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 16 | var iC=Object.create;var{getPrototypeOf:tC,defineProperty:XE,getOwnPropertyNames:JC}=Object;var VC=Object.prototype.hasO | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 42 | $RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a | CODE |
| MEDIUM | bench/react-hello-world/react-hello-world.workerd.js | 42 | $RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a | CODE |
| MEDIUM | bench/site/bench/bundler.sh | 2 | # rolldown/benchmarks harness on apps/10000 (10k React components / ~19k modules): vite, rsbuild, rspack, rollup, rolldo | COMMENT |
| MEDIUM | bench/site/bench/bundler.sh | 3 | # The harness runs `bun build` via `bun` on PATH, so a shim dir pointing at $BUN goes first on PATH. | COMMENT |
| MEDIUM | test/js/web/structured-clone-blob-file.test.ts | 380 | // payload; keeps the test robust against wire-format header changes. | COMMENT |
| MEDIUM | test/js/web/structured-clone-blob-file.test.ts | 797 | // test stays robust against outer serializer framing changes. | COMMENT |
| MEDIUM | …js/bun/http/serve-response-stream-sink-leak-fixture.ts | 71 | // is robust to both ends; a min would pass on one dip even while the sink leaks. | COMMENT |
| MEDIUM | test/js/bun/gc/gc-controller-cadence.test.ts | 138 | // Observed ~128 before the fix. A generous ceiling keeps this robust | COMMENT |
| MEDIUM | …/node/test/parallel/test-timers-unrefed-in-callback.js | 14 | // robust is that: | COMMENT |
| MEDIUM | …st/js/node/test/parallel/test-http2-session-timeout.js | 50 | // connection as the timeout should be robust. Double it anyway for good | COMMENT |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1473 | "sentinel.ts": "// Certainly reported: `= undefined` on a parameter and a default on a required property.\nexport fun | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1500 | "sentinel.ts": "// Certainly reported: noStrictNullCheck at the start of the file, and `= undefined` on a parameter.\ | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1539 | "sentinel.ts": "// Certainly reported with these options: a string literal, an object literal, undefined.\nfunction s | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1561 | "sentinel.ts": "// Certainly reported with allowThrowingAny: false: a value of type any, and a string literal.\ndecla | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1584 | "sentinel.ts": "// Certainly reported with allowThrowingUnknown: false: a value of type unknown, and a string literal | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1640 | "sentinel.ts": "// Certainly reported with these options: a string literal, an object literal, undefined.\nfunction s | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1922 | "sentinel.ts": "// Certainly reported by both: a plain `&&` chain over nullable objects.\ndeclare const s: {a?: {b: n | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1949 | "sentinel.ts": "// Certainly reported by both: a plain `&&` chain over nullable objects.\ndeclare const s: {a?: {b: n | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1967 | "sentinel.ts": "// Certainly reported by both: a plain `&&` chain over nullable objects.\ndeclare const s: {a?: {b: n | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 1991 | "sentinel.ts": "// Certainly reported by both: a plain `&&` chain over nullable objects.\ndeclare const s: {a?: {b: n | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 2014 | "sentinel.ts": "// Certainly reported by both: a plain `&&` chain over nullable objects.\ndeclare const s: {a?: {b: n | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 2902 | "sentinel.ts": "// Certainly reported with these options: line 3, switchIsNotExhaustive, Cases not matched: \"b\"\nde | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 2931 | "sentinel.ts": "// Certainly reported with these options: line 3 (switchIsNotExhaustive, \"b\") and line 12 (dangerou | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 2953 | "sentinel.ts": "// Certainly reported with these options: line 3, switchIsNotExhaustive, Cases not matched: \"b\"\nde | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 2976 | "sentinel.ts": "// Certainly reported with these options: line 3, switchIsNotExhaustive, Cases not matched: \"b\"\nde | CODE |
| MEDIUM | test/cli/lint/oracle/plugins/oxlint/audit.json | 3292 | "sentinel.ts": "// Certainly reported with these options: each type parameter is used once in its signature.\nexport | CODE |
| MEDIUM | test/regression/issue/29585.test.ts | 16 | // pattern) keeps the check robust against any future naming scheme. | COMMENT |
| MEDIUM | packages/h3blast/src/h3blast.c | 859 | // Rewind and erase the previous frame in one shot — robust to wrapped lines. | COMMENT |
| MEDIUM | .github/workflows/source-lints.yml | 94 | # paths, or `harness` (resolved via test/tsconfig.json `paths`), so a | COMMENT |
| MEDIUM | src/lint/typescript/rules/class_methods_use_this.rs | 6 | /// Enforce that class methods utilize `this`. | COMMENT |
| MEDIUM | src/lint/eslint/rules/class_methods_use_this.rs | 5 | /// Enforce that class methods utilize `this`. | COMMENT |
| MEDIUM | src/js/internal/repl/completion.ts | 612 | // upstream-todo(dario-piotrowicz): make this more robust, right now we only split by spaces | COMMENT |
| MEDIUM | src/js/node/http2.ts | 2727 | // seamless compatibility with http1. When the session is being torn down with an error | COMMENT |
| MEDIUM | src/bun_core/env_var.rs | 13 | //! but environment variables are not meant to be a robust configuration mechanism. If you do think | COMMENT |
| MEDIUM | src/bun_core/env_var.rs | 546 | /// Note that deserialization errors cannot panic. If you need more robust means of | COMMENT |
| MEDIUM | src/react_compiler/Cargo.toml | 10 | # Fixture-harness support: test-only `// @pragma` parsing, the pragma-gated | COMMENT |
| MEDIUM | …c/react_compiler/optimization/dead_code_elimination.rs | 507 | // Definitely safe to prune since they are read-only | COMMENT |
| MEDIUM | src/runtime/shell/interpreter.rs | 7 | //! performance reasons and also to leverage Bun's existing IO/FS code | COMMENT |
| MEDIUM | src/runtime/allocators/LinuxMemFdAllocator.rs | 2 | //! leverage copy-on-write memory to avoid actually copying the data. To do that | COMMENT |
| MEDIUM | src/runtime/bake/dev_server/source_map_store.rs | 337 | /// utilize the bottom 32 bits of their keys. This is because the bottom | COMMENT |
| MEDIUM | src/runtime/bake/bun-framework-react/server.tsx | 173 | // The RSC payload is provided so client-side can use this file for seamless | COMMENT |
| MEDIUM | src/runtime/bake/router/mod.rs | 456 | /// Fast enough for development to be seamless, but avoids building a | COMMENT |
| MEDIUM | src/runtime/socket/WindowsNamedPipe.rs | 6 | //! and Windows Named Pipe operations, enabling seamless cross-platform | COMMENT |
| MEDIUM | src/ast/expr.rs | 2374 | break 'brk left; // Definitely not null or undefined | CODE |
| MEDIUM | src/ast/expr.rs | 2378 | break 'brk PrimitiveType::Mixed; // Definitely some kind of primitive | CODE |
| MEDIUM | src/crash_handler/lib.rs | 2193 | // https://github.com/go-delve/delve/pull/1384 | COMMENT |
| MEDIUM | src/jsc/bindings/js_classes.ts | 3 | // tests if a value is an instanceof a native class in a robust cross-realm manner | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/net/tls-low-prio-queue-fixture.ts | 363 | // Step 2: every ClientHello becomes readable in the next iteration. | COMMENT |
| LOW | …est/parallel/test-http-agent-free-socket-data-guard.js | 31 | // Step 1: Send request1 | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 55 | // Step 2: Server injects a poisoned response while socket is idle | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 64 | // Step 3: Allow the event loop to poll I/O so the guard can fire. | COMMENT |
| LOW⚡ | …est/parallel/test-http-agent-free-socket-data-guard.js | 73 | // Step 4: Send request2 — should get a fresh connection | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 417 | // Step 4: convert V with ECMA-262 ToNumber. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 420 | // Step 5: normalize -0 to +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 455 | // Step 8: NaN, +0, -0, and infinities become +0. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 460 | // Step 9: truncate to IntegerPart(x). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 483 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 488 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 505 | // Step 10: reduce modulo 2^bitLength. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 509 | // Step 11: wrap into the signed range when the high bit is set. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 514 | // Step 12: return the unsigned value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 636 | // Step 2: throw unless S is one of the enumeration values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 643 | // Step 3: return the matching enumeration value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 713 | // Step 1: reject non-object, non-null, non-undefined values. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 721 | // Step 2: create the IDL dictionary value. | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 782 | // Step 2: GetMethod(V, %Symbol.iterator%). | COMMENT |
| LOW⚡ | …t/js/node/test/common/nodeinternals/internal/webidl.js | 784 | // Step 3: throw if the iterator method is undefined, null, or not callable. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 559 | // Step 2: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 762 | // Step 5: return the IDL dictionary. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 839 | // Step 2: otherwise throw. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 881 | // Step 3: reject non-fixed SharedArrayBuffer backing stores unless | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 950 | // Step 5: return a reference to the same object. | COMMENT |
| LOW | …t/js/node/test/common/nodeinternals/internal/webidl.js | 1016 | // Step 4: return a reference to the same ArrayBuffer. | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 660 | // Step 1: Insert a row (succeeds) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 666 | // Step 2: Try to insert conflicting row (throws expected error) | COMMENT |
| LOW⚡ | test/js/sql/sql.test.ts | 675 | // Step 3: Try another query - THIS WILL HANG | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 25 | // Step 1: Check if stdin is piped | COMMENT |
| LOW⚡ | test/regression/issue/tui-app-tty-pattern.test.ts | 34 | // Step 2: After stdin EOF, try to reopen /dev/tty | COMMENT |
| LOW | test/bundler/bundler_compile.test.ts | 1492 | // Step 2: Run bun build with compile, minify, sourcemap, and bytecode | COMMENT |
| LOW | packages/bun-lambda/README.md | 21 | ### Step 1: Create a Bun Lambda handler function | COMMENT |
| LOW | packages/bun-lambda/README.md | 58 | ### Step 2: Build the Bun handler | COMMENT |
| LOW | packages/bun-lambda/README.md | 65 | ### Step 3: Create the Lambda function on AWS | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 115 | // Step 1: Merge affected scopes to their canonical root. | COMMENT |
| LOW | …react_compiler/inference/align_object_method_scopes.rs | 166 | // Step 2: Repoint identifiers whose scopes were merged | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 266 | // Step 1: Collect rewrites | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 269 | // Step 2: Apply rewrites by splitting blocks | COMMENT |
| LOW | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 328 | // Step 3: Repoint phis when they refer to a rewritten block | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 348 | // Step 4: Fixup HIR to restore RPO, correct predecessors, renumber instructions | COMMENT |
| LOW⚡ | …mpiler/inference/build_reactive_scope_terminals_hir.rs | 353 | // Step 5: Fix scope and identifier ranges to account for renumbered instructions | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 100 | // Step 2: Calculate hoistable dependencies using the tree. | COMMENT |
| LOW⚡ | …compiler/inference/propagate_scope_dependencies_hir.rs | 110 | // Step 3: Reduce dependencies to a minimal set. | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1112 | // Step 1: Collect identifier to function expression mappings | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1140 | // Step 2: Forward pass to analyze assumed function calls | COMMENT |
| LOW | …compiler/inference/propagate_scope_dependencies_hir.rs | 1213 | // Step 3: Propagate assumed-invoked status through mayInvoke chains | COMMENT |
| LOW | src/runtime/server/StaticRoute.rs | 505 | // Step 1: If-Match (strong comparison); step 2: If-Unmodified-Since | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 522 | // Step 3: If-None-Match (weak comparison). Presence suppresses step 4. | COMMENT |
| LOW⚡ | src/runtime/server/StaticRoute.rs | 528 | // Step 4: If-Modified-Since (only when If-None-Match is absent). | COMMENT |
| LOW | src/runtime/webcore/Body.rs | 1809 | // Step 1: If this is unusable, throw a TypeError. | COMMENT |
| LOW | src/runtime/webcore/Body.rs | 1824 | // Step 2: null body → a new empty closed ReadableStream. | COMMENT |
| LOW | src/jsc/bindings/NodeVM.cpp | 1479 | // Step 1: Argument validation | COMMENT |
| LOW | src/jsc/bindings/NodeVM.cpp | 1522 | // Step 3: Create a new function | COMMENT |
| LOW | src/jsc/bindings/BunHeapProfiler.cpp | 280 | // Step 1: Build post-order indexes via DFS from root (node 0) | COMMENT |
| LOW | src/jsc/bindings/BunHeapProfiler.cpp | 362 | // Step 2: Build dominator tree using Cooper-Harvey-Kennedy algorithm | COMMENT |
| LOW | src/jsc/bindings/BunHeapProfiler.cpp | 480 | // Step 3: Calculate retained sizes by attributing size up the dominator tree | COMMENT |
| LOW | src/bundler/linker_context/scanImportsAndExports.rs | 136 | // Step 1: Figure out what modules must be CommonJS | COMMENT |
| LOW | src/bundler/linker_context/scanImportsAndExports.rs | 430 | // Step 2: Propagate dynamic export status for export star statements that | COMMENT |
| LOW | src/bundler/linker_context/scanImportsAndExports.rs | 504 | // Step 3: Resolve "export * from" statements. This must be done after we | COMMENT |
| 4 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 12 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 59 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 124 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 197 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 437 | CODE | |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 899 | CODE | |
| LOW | test/aot/tools/code_in_image.py | 248 | CODE | |
| LOW | test/aot/tools/code_in_image.py | 65 | CODE | |
| LOW | test/aot/tools/code_in_image.py | 171 | CODE | |
| LOW | test/aot/tools/exact_counts.py | 44 | CODE | |
| LOW | test/aot/tools/exact_counts.py | 175 | CODE | |
| LOW | test/aot/tools/exact_counts.py | 196 | CODE | |
| LOW | test/aot/tools/name_sample.py | 62 | CODE | |
| LOW | test/aot/shell/where-it-died.py | 52 | CODE | |
| LOW | test/aot/shell/where-it-died.py | 183 | CODE | |
| LOW | test/aot/shell/expectations.py | 131 | CODE | |
| LOW | test/aot/shell/expectations.py | 297 | CODE | |
| LOW | test/aot/shell/toolchain.py | 86 | CODE | |
| LOW | test/aot/backend/card.py | 151 | CODE | |
| LOW | test/aot/backend/measure/measure.py | 211 | CODE | |
| LOW | test/aot/backend/measure/memory_kinds.py | 59 | CODE | |
| LOW | test/aot/backend/measure/memory_kinds.py | 78 | CODE | |
| LOW | test/aot/backend/measure/memory.py | 54 | CODE | |
| LOW | test/aot/fuzz/made/random-esm-namespace-as-value.py | 39 | CODE | |
| LOW | …st/aot/fuzz/made/random-commonjs-and-esm-with-hooks.py | 51 | CODE | |
| LOW | test/aot/fuzz/made/variables-read-before-store.py | 30 | CODE | |
| LOW | test/aot/fuzz/made/random-commonjs-and-esm.py | 49 | CODE | |
| LOW | test/aot/fuzz/fuzzilli/counters-as-coverage.py | 32 | CODE | |
| LOW | test/aot/fuzz/generators/python/control-flow.py | 48 | CODE | |
| LOW | test/aot/fuzz/generators/python/control-flow.py | 157 | CODE | |
| LOW | …aot/fuzz/generators/python/element-reads-and-stores.py | 74 | CODE | |
| LOW | test/aot/fuzz/generators/python/appended-strings.py | 67 | CODE | |
| LOW | …/fuzz/generators/python/regular-expression-literals.py | 28 | CODE | |
| LOW | …/fuzz/generators/python/regular-expression-literals.py | 157 | CODE | |
| LOW | …ot/fuzz/generators/python/reference-holding-members.py | 40 | CODE | |
| LOW | …ot/fuzz/generators/python/reference-holding-members.py | 89 | CODE | |
| LOW | …ot/fuzz/generators/python/reference-holding-members.py | 305 | CODE | |
| LOW | …st/aot/fuzz/generators/python/maybe-integer-numbers.py | 83 | CODE | |
| LOW | test/aot/fuzz/generators/python/async-code-order.py | 70 | CODE | |
| LOW | test/aot/fuzz/generators/python/async-code-order.py | 86 | CODE | |
| LOW | …ot/fuzz/generators/python/async-generator-job-order.py | 25 | CODE | |
| LOW | …ot/fuzz/generators/python/async-generator-job-order.py | 43 | CODE | |
| LOW | test/aot/fuzz/generators/python/microtask-order.py | 33 | CODE | |
| LOW | test/aot/fuzz/generators/python/resource-management.py | 90 | CODE | |
| LOW | …uzz/generators/python/async-generator-steps-by-hand.py | 25 | CODE | |
| LOW | test/aot/fuzz/generators/python/spreads-as-records.py | 67 | CODE | |
| LOW | test/aot/fuzz/generators/python/spreads-as-records.py | 131 | CODE | |
| LOW | test/aot/fuzz/generators/python/spreads-as-records.py | 199 | CODE | |
| LOW | test/aot/fuzz/generators/python/for-in-loops.py | 75 | CODE | |
| LOW | …ot/fuzz/generators/python/async-generator-pipelines.py | 39 | CODE | |
| LOW | …ot/fuzz/generators/python/async-generator-pipelines.py | 62 | CODE | |
| LOW | …st/aot/fuzz/generators/python/throw-and-catch-pairs.py | 63 | CODE | |
| LOW | test/aot/fuzz/generators/python/tail-calls.py | 106 | CODE | |
| LOW | test/aot/fuzz/generators/python/typed-programs.py | 213 | CODE | |
| LOW | test/aot/fuzz/generators/python/typed-programs.py | 239 | CODE | |
| LOW | test/aot/fuzz/generators/python/typed-programs.py | 315 | CODE | |
| LOW | test/aot/fuzz/generators/python/typed-programs.py | 465 | CODE | |
| LOW | test/aot/fuzz/generators/python/exception-paths.py | 229 | CODE | |
| LOW | …ators/python/repeated-groups-that-can-match-nothing.py | 103 | CODE | |
| LOW | …generators/python/instances-not-made-by-their-class.py | 9 | CODE | |
| 13 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 992 | except: | CODE |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 925 | except: | CODE |
| HIGH | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 616 | except: | CODE |
| HIGH | test/js/node/readline/run-with-pty.py | 33 | except: | CODE |
| HIGH | test/aot/shell/expectations.py | 318 | except toolchain.ToolFailed: pass | CODE |
| HIGH | test/aot/backend/measure/measure.py | 177 | except OSError: | CODE |
| HIGH | test/aot/backend/measure/measure.py | 263 | except (OSError, ValueError, IndexError): | CODE |
| HIGH | test/aot/fuzz/fuzzilli/counters-as-coverage.py | 35 | except FileNotFoundError: pass | CODE |
| HIGH | test/aot/servers/measure/measure.py | 254 | except (OSError, ValueError, IndexError): | CODE |
| HIGH | test/aot/servers/measure/measure.py | 409 | except subprocess.TimeoutExpired: | CODE |
| HIGH | test/aot/servers/measure/cost_by_request.py | 141 | except (OSError, IndexError): | CODE |
| HIGH | test/aot/servers/measure/requests_a_second.py | 73 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/hawk/README.md | 22 | git checkout -- src/runtime/Cargo.toml && rm -f src/runtime/hawk_root.rs # revert the scaffolding | CODE |
| MEDIUM | scripts/orderfile/app/servers.js | 2 | // The child is this same executable (`<app> netserver`, see scaffold.js). It is | COMMENT |
| MEDIUM | scripts/orderfile/app/scaffold.js | 3 | // bun scaffold.js <outdir> | COMMENT |
| MEDIUM⚡ | src/runtime/api.rs | 141 | // ─── shared scaffold for Bun.{TOML,JSONC,JSON5,YAML,XML}.parse ─────────────── | COMMENT |
| MEDIUM⚡ | src/runtime/api.rs | 144 | // class and the Expr→JS tail, so this helper owns ONLY the scaffold and hands `(&arena, &mut log, &source)` to a | COMMENT |
| MEDIUM⚡ | src/runtime/test_runner/expect.rs | 1787 | // ─── unary-predicate matcher scaffold ──────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/runtime/test_runner/expect.rs | 1792 | /// Shared scaffold for zero-arg `expect(v).toBeX()` matchers whose pass/fail | COMMENT |
| MEDIUM | src/runtime/test_runner/expect.rs | 1820 | /// Shared scaffold for one-arg `expect(v).toStartWith/toEndWith/toInclude(expected)` | COMMENT |
| MEDIUM⚡ | src/runtime/timer/mod.rs | 31 | // Shared scaffold for `TimeoutObject` / `ImmediateObject`: both are a | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 6 | CODE | |
| LOW | test/js/node/readline/run-with-pty.py | 5 | CODE | |
| LOW | test/aot/tools/exact_counts.py | 25 | CODE | |
| LOW | test/aot/shell/expectations.py | 53 | CODE | |
| LOW | test/aot/fuzz/generators/python/control-flow.py | 6 | CODE | |
| LOW | …aot/fuzz/generators/python/element-reads-and-stores.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/sloppy-code.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/async-generators.py | 6 | CODE | |
| LOW | …/fuzz/generators/python/regular-expression-literals.py | 6 | CODE | |
| LOW | …ot/fuzz/generators/python/reference-holding-members.py | 5 | CODE | |
| LOW | …st/aot/fuzz/generators/python/maybe-integer-numbers.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/async-code-order.py | 6 | CODE | |
| LOW | …/aot/fuzz/generators/python/intl-constant-arguments.py | 5 | CODE | |
| LOW | …/aot/fuzz/generators/python/intl-constant-arguments.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/spreads-as-records.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/for-in-loops.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/host-visible-values.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/lazy-constants.py | 5 | CODE | |
| LOW | …st/aot/fuzz/generators/python/throw-and-catch-pairs.py | 7 | CODE | |
| LOW | test/aot/fuzz/generators/python/tail-calls.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/one-object-two-types.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/calls-by-value.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/switch-statements.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/objects.py | 6 | CODE | |
| LOW | test/aot/fuzz/generators/python/strings.py | 5 | CODE | |
| LOW | test/aot/fuzz/generators/python/maps-and-sets.py | 5 | CODE | |
| LOW | …uzz/generators/python/intl-constant-arguments/flows.py | 4 | CODE | |
| LOW | test/aot/servers/measure/measure.py | 113 | CODE | |
| LOW | misctools/lldb/bun_pretty_printer.py | 3 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 929 | print("Error: yaml package is not installed. Please run: npm install yaml") | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 431 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1025 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1072 | except Exception as e: | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 1117 | except Exception as e: | STRING |
| LOW | test/aot/backend/measure/measure.py | 167 | except Exception: | CODE |
| LOW | test/aot/backend/measure/measure.py | 561 | except Exception as e: | CODE |
| MEDIUM | test/aot/backend/measure/measure.py | 154 | def rollup(pid): | CODE |
| MEDIUM | test/aot/backend/measure/measure.py | 187 | def children(parent): | CODE |
| LOW | test/aot/perf/against_the_jit.py | 125 | except Exception as error: | CODE |
| LOW | test/aot/servers/measure/measure.py | 534 | except Exception as error: | CODE |
| LOW | test/aot/servers/measure/measure.py | 575 | except Exception as error: | CODE |
| LOW | test/aot/servers/measure/measure.py | 615 | except Exception as error: | CODE |
| LOW | test/aot/servers/measure/measure.py | 643 | except Exception as error: | CODE |
| MEDIUM | test/aot/servers/measure/measure.py | 388 | def main_thread_ns(self): | CODE |
| LOW | test/aot/servers/measure/requests_a_second.py | 193 | except Exception as error: | CODE |
| LOW | misctools/lldb/bun_pretty_printer.py | 302 | except Exception as e: | CODE |
| MEDIUM | misctools/lldb/bun_pretty_printer.py | 43 | def bun_BabyList_SummaryProvider(value, _=None): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/web/fetch/fixture.html | 1115 | bun implements Node.js' module resolution algorithm, so you can use npm packages in Bun. ESM and | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 1579 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n# [fruit.apple] # INVALID\n# [fruit.apple.taste] # IN | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 1696 | '# This makes the key "fruit" into a table.\nfruit.apple.smooth = true\n\n# So then you can add to the table "frui | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 6546 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n[fruit.apple] # INVALID\n# [fruit.apple.taste] # INVA | CODE |
| MEDIUM | test/js/bun/toml/toml-test-suite.test.ts | 6559 | '[fruit]\napple.color = "red"\napple.taste.sweet = true\n\n# [fruit.apple] # INVALID\n[fruit.apple.taste] # INVA | CODE |
| LOW | test/js/bun/css/files/tachyons.css | 692 | 2. Don't forget to clearfix your floats with .cf | CODE |
| LOW | packages/bun-usockets/src/internal/internal.h | 111 | #define POLL_TYPE_BITSIZE 5 // make sure to update epoll_kqueue.h if you change this | COMMENT |
| LOW | packages/bun-usockets/src/internal/loop_data.h | 35 | // IMPORTANT: When changing this, don't forget to update the Rust mirror in src/uws_sys/InternalLoopData.rs as well! | COMMENT |
| LOW | src/sql_jsc/postgres/PostgresSQLConnection.rs | 2046 | // explicit use switch without else so if new modes are added, we don't forget to check for duplicate fi | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/js/node/test/sequential/test-init.js | 52 | // test-init-index is in fixtures dir as requested by ry, so go there | COMMENT |
| HIGH | src/sema/check/errors_iteration.rs | 589 | /// `getContextuallyTypedParameterType` for parameter `index` of `func`, as requested by | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …/fuzz/made/array-from-subclasses-and-native-setters.py | 0 | const say = f => { try { const v = f(); return typeof v === 'string' ? json.stringify(v) : typeof v === 'symbol' ? v.tos | STRING |
| HIGH | …ot/fuzz/made/frozen-arrays-namespaces-out-of-bounds.py | 0 | const say = f => { try { const v = f(); return typeof v === 'string' ? json.stringify(v) : typeof v === 'symbol' ? v.tos | STRING |
| HIGH | …t/fuzz/made/arrays-iterators-and-sloppy-only-syntax.py | 0 | const say = f => { try { const v = f(); return typeof v === 'string' ? json.stringify(v) : typeof v === 'symbol' ? v.tos | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/bun/shell/bunshell.test.ts | 2164 | # Check if we got a non-empty, non-null version string | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 83 | # Check if this is a stringified collection from yaml package | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 168 | # Check if this is a simple object | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 837 | # Check if it's in an array context | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 841 | # Check if it's in mapping values (not keys) | COMMENT |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 465 | # Check if this is an error test (has 'error' file) | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 699 | # Check if YAML has anchors/aliases | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 914 | # Check if yaml package is installed (for getting expected values) | STRING |
| LOW | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 939 | # Check if this is a test directory (has in.yaml) | STRING |
| LOW | scripts/lldb-inline.sh | 11 | # Check if we need to rebuild | COMMENT |
| LOW | packages/bun-types/test.d.ts | 76 | * ## Set Date to a specific time | COMMENT |
| LOW | misctools/lldb/bun_pretty_printer.py | 75 | # Check if it's a pointer type and dereference if needed | COMMENT |
| LOW | misctools/lldb/bun_pretty_printer.py | 85 | # Check if it's 8-bit (latin1) or 16-bit (utf16) string | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/node/url/url-null-char.test.js | 6 | // TODO: Fix error properties | COMMENT |
| LOW | test/bake/dev/esm.test.ts | 261 | const esmImport = await import('./esm'); // TODO: implement sync ESM | CODE |
| LOW | src/runtime/cli/run_command.rs | 438 | let ipc_fd: Option<bun_sys::Fd> = None; // TODO: implement on Windows | CODE |
| LOW | src/runtime/bake/dev_server/ensure_route.rs | 102 | // TODO: implement a proper solution here | COMMENT |
| LOW | src/runtime/bake/dev_server/directory_watch_store.rs | 334 | // TODO: implement that. for now it ignores (BUN-10968) | COMMENT |
| LOW | src/runtime/webcore/Blob.rs | 4774 | // TODO: implement a writev() fast path | COMMENT |
| LOW | src/ast/fold_string_addition.rs | 58 | // TODO: implement foldAdditionPreProcess to fold some more things :) | COMMENT |
| LOW | src/js_parser/parse/mod.rs | 959 | // TODO: implement saveExprCommentsHere and use using_loc here | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/zlib/lib.rs | 108 | /// In this implementation, inflate() always flushes as much output as possible to the output buffer, and always use | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/js/third_party/remix/remix-build/server/index.js | 8 | function handleRequest(request, responseStatusCode, responseHeaders, remixContext, loadContext) { | CODE |
| LOW | …st/js/node/test/parallel/test-http2-ip-address-host.js | 34 | function handleRequest(url) { | CODE |
| LOW | …rallel/test-async-hooks-stack-overflow-nested-async.js | 31 | function processData(data, depth = 0) { | CODE |
| LOW | test/bake/dev/hot.test.ts | 70 | export function doSomething() { | CODE |
| LOW | test/bake/dev/server-sourcemap.test.ts | 125 | "lib/utils.ts": `export function doSomething() { | CODE |
| LOW | test/regression/issue/25648.test.ts | 15 | export function doSomething(fn: () => number) { | CODE |
| LOW | test/bundler/bundler_edgecase.test.ts | 3497 | export function getData() { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/sync-react-compiler.sh | 14 | # Usage: | COMMENT |
| LOW | scripts/update-sqlite-amalgamation.sh | 8 | # Usage: | COMMENT |
| LOW | misctools/unicode-generator.ts | 119 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/js/bun/yaml/translate_yaml_test_suite_to_bun.py | 384 | # Create a temporary JavaScript file to parse the YAML | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …generators/python/instances-not-made-by-their-class.py | 55 | CODE | |
| LOW | test/aot/perf/operations/generate.py | 14 | CODE | |
| LOW | misctools/lldb/lldb_webkit.py | 648 | CODE |