whatwg-url 17.2.0

Source: https://github.com/jsdom/whatwg-url
Tag scanned: v17.2.0
Compared with: v17.1.2 (0 signals introduced since)
Files: 26 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:19

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution live-viewer/live-viewer.mjs:214:19

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  const byteString = Array.from(bytes, byte => String.fromCharCode(byte)).join("");
  const encoded = btoa(byteString);
  return encoded;
}
```
info ~~warn~~ → info by review dynamic-execution live-viewer/live-viewer.mjs:219:22

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeFromBase64(encoded) {
  const byteString = atob(encoded);
  const bytes = Uint8Array.from(byteString, char => char.charCodeAt(0));
  const originalString = td.decode(bytes);
```
likely benign LLM, confidence 0.85 A helper function decodes a base64 string to UTF-8 text using atob and TextDecoder-style logic.
Reasoning
The snippet shows atob used to decode a base64 string into bytes and then decode them as UTF-8 text. This is a standard, legitimate utility for handling encoded data in a browser or Node viewer. Nothing here is eval, fetch of decoded content, or a dropper pipeline. The finding only flags the presence of atob, which is common in benign code. The surrounding context is not shown, so a small doubt remains about what the decoded value is used for.

info unicode-surrogate test/validation.js:346:34

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  { input: "https://example.com/#\u{10FFFF}", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },
  { input: "https://example.com/#\uD800", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },

  // Host strings.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsdom/whatwg-url whatwg-url && cd whatwg-url
git checkout v17.2.0
disclude scan --severity info --diff v17.1.2 .