whatwg-url 17.3.0

Source: https://github.com/jsdom/whatwg-url
Tag scanned: v17.3.0
Compared with: v17.2.0 (0 signals introduced since)
Files: 27 scanned, 4 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 2.2 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 1 of 1 warn and critical signal; 1 demoted to info.
Disclude version: 4.1.0
Scanned (UTC): 2026-10-22 12:53

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info dynamic-execution live-viewer/live-viewer.mjs:214:19

`btoa` encodes a value as base64 at runtime — used in exfiltration patterns (ast pass, confidence 0.55)
```
  const byteString = Array.from(bytes, byte => String.fromCharCode(byte)).join("");
  const encoded = btoa(byteString);
  return encoded;
}
```
info ~~warn~~ → info by review dynamic-execution live-viewer/live-viewer.mjs:219:22

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)
```
function decodeFromBase64(encoded) {
  const byteString = atob(encoded);
  const bytes = Uint8Array.from(byteString, char => char.charCodeAt(0));
  const originalString = td.decode(bytes);
```
likely benign LLM, confidence 0.90 A helper function decodes a base64 string into UTF-8 text using atob and TextDecoder.
Reasoning
The snippet decodes base64 to bytes and then decodes those bytes as UTF-8 text, a standard pattern for handling Unicode strings in browsers or Node. There is no eval, dynamic import, fetch, or execution of the decoded value shown. The flagged signal is a generic heuristic on atob, and the code is a plain data-decoding helper in a live viewer tool.

info unicode-surrogate test/validation.js:346:34

orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)

  { input: "https://example.com/#\u{10FFFF}", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },
  { input: "https://example.com/#\uD800", validURLString: false, parserValidationErrors: ["invalid-URL-unit"] },

  // Host strings.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/jsdom/whatwg-url whatwg-url && cd whatwg-url
git checkout v17.3.0
disclude scan --severity info --diff v17.2.0 .