whatwg-url 17.3.0

Source: https://github.com/jsdom/whatwg-url
Tag scanned: v17.3.0
Compared with: v17.2.0 (0 signals introduced since)
Files: 26 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.1 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-15 02:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution live-viewer/live-viewer.mjs:214:19

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  const byteString = Array.from(bytes, byte => String.fromCharCode(byte)).join("");
  const encoded = btoa(byteString);
  return encoded;
}
```
info ~~warn~~ → info by review dynamic-execution live-viewer/live-viewer.mjs:219:22

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeFromBase64(encoded) {
  const byteString = atob(encoded);
  const bytes = Uint8Array.from(byteString, char => char.charCodeAt(0));
  const originalString = td.decode(bytes);
```
likely benign LLM, confidence 0.90 A helper function decodes a base64 string into UTF-8 text using atob and TextDecoder.
Reasoning
The snippet shows atob used to decode base64 into bytes and then decode them as UTF-8 text via TextDecoder. This is a generic utility for transporting Unicode strings, with no eval, fetch, or dropper behavior visible. The finding's own message only says it is a common step before dynamic execution, and nothing in the snippet shows that. The decoded value is not passed to any execution sink here.

info unicode-surrogate test/validation.js:346:34

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  { input: "https://example.com/#\u{10FFFF}", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },
  { input: "https://example.com/#\uD800", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },

  // Host strings.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/jsdom/whatwg-url whatwg-url && cd whatwg-url
git checkout v17.3.0
disclude scan --severity info --diff v17.2.0 .