jsdom 30.1.3

Source: https://github.com/jsdom/jsdom
Tag scanned: v30.1.3
Compared with: v30.1.2 (1 signals introduced since)
Files: 532 scanned, 679 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 28 info
Scan time: 7.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 10 of 10 warn and critical signals; 10 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-16 01:10

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-import scripts/generate-css-style-properties.js:74:37 new in this release

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
    // The property implementations can be loaded now that their definitions have been generated.
    const { shorthandProperties } = require(path.resolve(cssDir, "helpers/shorthand-properties.js"));
    const longhandsByShorthand = new Map();
    const shorthandsByLonghand = new Map();
```
likely benign LLM, confidence 0.85 Build script loads a local shorthand-properties helper module.
Reasoning
Build script requiring a helper module via path.resolve under a known project directory. Normal code-generation tooling with no untrusted input.
info ~~warn~~ → info by review dynamic-import benchmark/lib.js:33:19

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
async function runSuite(suiteName) {
  const factory = require(path.join(benchmarkDir, suiteName));
  const bench = factory();
  await bench.run();
```
likely benign LLM, confidence 0.80 Benchmark runner dynamically requires a suite module by name from a local directory.
Reasoning
Dynamic require of a path built from a suite name in a benchmark runner. Non-literal require is a notable pattern but the context is a local benchmark harness loading its own suite files; no network or encoded payload involved.
info ~~warn~~ → info by review dynamic-execution lib/jsdom/browser/Window.js:787:14

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
    try {
      return atob(str);
    } catch {
      // Convert Node.js DOMException to one from our global.
```
likely benign LLM, confidence 0.85 Implementation of window.atob base64 decoding in jsdom.
Reasoning
atob is used as a plain base64 decoder inside a try/catch that converts DOMException, which is the standard implementation of the window.atob API. The decoded string is returned, not executed.
info dynamic-execution lib/jsdom/browser/Window.js:799:14

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
    try {
      return btoa(str);
    } catch {
      // Convert Node.js DOMException to one from our global.
```
info ~~critical~~ → info by review dynamic-execution lib/jsdom/living/helpers/create-event-accessor.js:128:7

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
      // eslint-disable-next-line no-new-func
      Function(body); // properly error out on syntax errors
      // Note: this won't execute body; that would require `Function(body)()`.
    } catch (e) {
```
likely benign LLM, confidence 0.90 Syntax-check of event handler attribute body via Function constructor, with a comment stating it is not executed.
Reasoning
The comment explicitly states the Function constructor is used only to validate syntax and the body is not executed. This is a known, documented technique for compiling event handler attribute bodies in jsdom; it is a legitimate use of Function, though it is a dynamic code construct.
info ~~warn~~ → info by review dynamic-import scripts/generate-css-style-properties.js:122:32

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
        descriptorSource = `${camelizedProperty}.descriptor`;
        const implementation = require(path.resolve(propertiesDir, fileName));
        if (typeof implementation.resolveComputedValue === "function") {
          computedValueResolverRequires.push(
```
likely benign LLM, confidence 0.85 Generator script dynamically requires property implementation files from the repo.
Reasoning
Code generator requiring each property implementation file from a local directory during generation. Standard build tooling pattern.
info ~~warn~~ → info by review encoding-base64 test/api/resources.js:600:12

base64-like blob (92 bytes, compression ratio 0.99) (raw pass, confidence 0.60)
```
        element.src = "data:image/png;base64," +
          "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkqAcAAIUAgUW0RjgAAAAASUVORK5CYII=";
        dom.window.document.body.appendChild(element);
```
likely benign LLM, confidence 0.90 Test fixture embedding a small base64 PNG data URI.
Reasoning
A small embedded PNG data URI used as an image src in a test. The base64 is a real tiny PNG, consistent with test fixtures; no decoding to executable code.
info whitespace-anomaly test/to-port-to-wpts/files/DOMTestCase.js:13:1

file mixes tab and space indentation (17 tab-indented and 180 space-indented lines) (raw pass, confidence 0.40)
```
exports.assertSize = function(descr, expected, actual) {
  var actualSize;
  assertNotNull(descr, actual);
  actualSize = actual.length;
```
info ~~warn~~ → info by review long-line test/to-port-to-wpts/files/image.txt:1:1

line length 3510 characters (raw pass, confidence 0.65)
```
data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKgAAACoCAYAAAB0S6W0AAAABmJLR0QA/wD/AP+gvaeTAAAJ7ElEQVR4nO3dX0yb9R7H8c+zwijNYHQdDDY7UzaWoRSjXizTQyTRGJPGbEYvTAgX58QLY+LfeG2OXnuGjhtONq7Ikl2OiyVqtgRDiI5Ejes8IyBjggp2qx0g0FLb37n4DgseB33a56Hfnn1eSZNlK6W/X988/fX5tczC/ceU+g4UySr1HdhOO0p9B4g2w0BJNQZKqjFQUo2BkmoMlFRjoKQaAyXVGCipxk
```
likely benign LLM, confidence 0.90 Test fixture text file holding a base64-encoded image.
Reasoning
A text file containing a long base64-encoded PNG image, a test fixture. Long line is simply the encoded image data.
info ~~critical~~ → info by review dynamic-execution test/to-port-to-wpts/jquery-fixtures/jquery-1.11.0.js:8550:5

`Function(...)` called with a non-literal body (ast pass, confidence 0.90)
```
	}) ) ?
		( Function( "return " + str ) )() :
		jQuery.error( "Invalid JSON: " + data );
};
```
likely benign LLM, confidence 0.90 Vendored jQuery 1.11.0 legacy JSON parsing fallback using Function constructor.
Reasoning
This is the well-known jQuery parseJSON fallback that uses Function to parse JSON when native JSON.parse is unavailable, in a vendored jQuery fixture. Legitimate library code from an old jQuery version.
info unicode-homoglyph test/to-port-to-wpts/level1/core.js:3210:37

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    testNode = addressList.item(2);
    testNode.setAttribute("class", "Yα");
    attributes = testNode.attributes;
```
info unicode-mixed-script test/to-port-to-wpts/level1/core.js:3210:37

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
    testNode = addressList.item(2);
    testNode.setAttribute("class", "Yα");
    attributes = testNode.attributes;
```
info unicode-homoglyph test/to-port-to-wpts/level1/html.js:195:26

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    assert.equal(value, "Yα", "attrValue1");
  });
```
info unicode-mixed-script test/to-port-to-wpts/level1/html.js:195:26

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
    assert.equal(value, "Yα", "attrValue1");
  });
```
info unicode-homoglyph test/to-port-to-wpts/level1/html.js:277:37

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)
```
    testNode = addressList.item(2);
    testNode.setAttribute("class", "Yα");
    attributes = testNode.attributes;
```
info unicode-mixed-script test/to-port-to-wpts/level1/html.js:277:37

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)
```
    testNode = addressList.item(2);
    testNode.setAttribute("class", "Yα");
    attributes = testNode.attributes;
```

info unicode-homoglyph test/to-port-to-wpts/level1/html.js:2558:27

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    let domesticAttr = doc.createAttribute("title");
    domesticAttr.value = "Yα";
    firstNode.setAttributeNode(domesticAttr);
    let attributes = doc.getElementsByTagName("acronym").item(2).attributes;

info unicode-mixed-script test/to-port-to-wpts/level1/html.js:2558:27

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

    let domesticAttr = doc.createAttribute("title");
    domesticAttr.value = "Yα";
    firstNode.setAttributeNode(domesticAttr);
    let attributes = doc.getElementsByTagName("acronym").item(2).attributes;

info whitespace-anomaly test/to-port-to-wpts/level3/core/files/datatype_normalization.xml.js:6:1

file mixes tab and space indentation (5 tab-indented and 44 space-indented lines) (raw pass, confidence 0.40)
```
<!ATTLIST svg 
	xmlns CDATA #IMPLIED
	xmlns:xsi CDATA #IMPLIED
	xsi:schemaLocation CDATA #IMPLIED>
```
info whitespace-anomaly test/to-port-to-wpts/level3/core/files/hc_nodtdstaff.xml.js:5:1

file mixes tab and space indentation (3 tab-indented and 125 space-indented lines) (raw pass, confidence 0.40)
```
  var doc = new dom.Document("html");
  var implementation = new dom.DOMImplementation(doc, {
    "XML" : ["1.0", "2.0"],
```

info unicode-homoglyph test/to-port-to-wpts/level3/core/files/hc_nodtdstaff.xml.js:21:55

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    doc,
    doc.createEntityNode("alpha", doc.createTextNode("α")),
    doc.createEntityNode("beta", doc.createTextNode("&#946;")),
    doc.createEntityNode("gamma", doc.createTextNode("&#947;")),

info unicode-homoglyph test/to-port-to-wpts/level3/core/files/hc_nodtdstaff.xml.js:140:39

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

  addresses[3].setAttribute("title", "Yes");
  addresses[3].setAttribute("class", "Yα");
  addresses[3].appendChild(doc.createTextNode("27 South Road. Dallas, Texas 98556"));
  names[3].appendChild(doc.createTextNode("Jeny Oconnor"));

info unicode-mixed-script test/to-port-to-wpts/level3/core/files/hc_nodtdstaff.xml.js:140:39

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

  addresses[3].setAttribute("title", "Yes");
  addresses[3].setAttribute("class", "Yα");
  addresses[3].appendChild(doc.createTextNode("27 South Road. Dallas, Texas 98556"));
  names[3].appendChild(doc.createTextNode("Jeny Oconnor"));

info unicode-homoglyph test/to-port-to-wpts/level3/core/files/hc_staff.xml.js:21:55

identifier `α` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

    doc,
    doc.createEntityNode("alpha", doc.createTextNode("α")),
    doc.createEntityNode("beta", doc.createTextNode("&#946;")),
    doc.createEntityNode("gamma", doc.createTextNode("&#947;")),

info unicode-homoglyph test/to-port-to-wpts/level3/core/files/hc_staff.xml.js:140:39

identifier `Yα` contains homoglyph candidates: α (03B1)→a (in string/comment) (raw pass, confidence 0.35)

  addresses[3].setAttribute("title", "Yes");
  addresses[3].setAttribute("class", "Yα");
  addresses[3].setAttribute("id", "emp4_addr");
  addresses[3].appendChild(doc.createTextNode("27 South Road. Dallas, Texas 98556"));

info unicode-mixed-script test/to-port-to-wpts/level3/core/files/hc_staff.xml.js:140:39

identifier `Yα` mixes scripts: Latin + Greek (in string/comment) (raw pass, confidence 0.40)

  addresses[3].setAttribute("title", "Yes");
  addresses[3].setAttribute("class", "Yα");
  addresses[3].setAttribute("id", "emp4_addr");
  addresses[3].appendChild(doc.createTextNode("27 South Road. Dallas, Texas 98556"));

info ~~warn~~ → info by review dynamic-import test/web-platform-tests/wpt-server.js:17:12

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
const configs = {
  default: require(configPaths.default),
  toUpstream: require(configPaths.toUpstream)
};
```
likely benign LLM, confidence 0.85 Test harness requires default WPT server configuration module.
Reasoning
Test server requiring config files from configPaths, which are local project configuration paths. Standard test harness configuration loading.
info ~~warn~~ → info by review dynamic-import test/web-platform-tests/wpt-server.js:18:15

`require` called with a non-literal specifier (ast pass, confidence 0.60)
```
  default: require(configPaths.default),
  toUpstream: require(configPaths.toUpstream)
};
```
likely benign LLM, confidence 0.85 Test harness requires upstream WPT server configuration module.
Reasoning
Same pattern as the adjacent line: loads the upstream WPT config from a local path in the test harness. Benign configuration loading.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsdom/jsdom jsdom && cd jsdom
git checkout v30.1.3
disclude scan --severity info --diff v30.1.2 .