@open-mercato/search
Hybrid search for Open Mercato: fulltext, vector, and token-based search in one module.
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): Test fixture value in ollama-url-safety tests, not live network call. | ai | |
| semgrep | semgrep:etc-passwd-access | AI (semgrep): Test asserting file:// scheme is rejected, not actual file access. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): Fires in a test file for env save/restore pattern; no runtime risk. | ai |
Versions (showing 14 of 14)
| Version | Deps | Published |
|---|---|---|
| 0.6.6 | 10 / 4 | |
| 0.6.5 | 10 / 3 | |
| 0.6.4 | 10 / 3 | |
| 0.6.3 | 10 / 3 | |
| 0.6.2 | 10 / 3 | |
| 0.6.1 | 10 / 3 | |
| 0.6.0 | 10 / 3 | |
| 0.5.0 | 10 / 3 | |
| 0.4.10 | 10 / 3 | |
| 0.4.9 | 10 / 3 | |
| 0.4.8 | 10 / 3 | |
| 0.4.7 | 10 / 3 | |
| 0.4.6 | 10 / 3 | |
| 0.4.5 | 10 / 3 |
v0.6.6
16 findingsHTTP request to raw IP address — legitimate packages use domain names 90 | model: 'nomic-embed-text', 91 | dimension: 768, > 92 | baseUrl: 'http://169.254.169.254/', 93 | updatedAt: new Date().toISOString(), 94 | },
HTTP request to raw IP address — legitimate packages use domain names 111 | model: 'nomic-embed-text', 112 | dimension: 768, > 113 | baseUrl: 'http://127.0.0.1:11434', 114 | updatedAt: new Date().toISOString(), 115 | },
HTTP request to raw IP address — legitimate packages use domain names 97 | model: 'nomic-embed-text', 98 | dimension: 768, > 99 | baseUrl: 'http://169.254.169.254/', 100 | }, 101 | }),
HTTP request to raw IP address — legitimate packages use domain names 46 | }) 47 | > 48 | it('accepts http://127.0.0.1:11434 in development', () => { 49 | process.env.NODE_ENV = 'development' 50 | expect(() => assertSafeOllamaBaseUrl('http://127.0.0.1:11434')).not.toThrow()
HTTP request to raw IP address — legitimate packages use domain names 48 | it('accepts http://127.0.0.1:11434 in development', () => { 49 | process.env.NODE_ENV = 'development' > 50 | expect(() => assertSafeOllamaBaseUrl('http://127.0.0.1:11434')).not.toThrow() 51 | }) 52 |
HTTP request to raw IP address — legitimate packages use domain names 63 | }) 64 | > 65 | it('rejects http://127.0.0.1:11434 in production', () => { 66 | process.env.NODE_ENV = 'production' 67 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://127.0.0.1:11434'))).toBe(
HTTP request to raw IP address — legitimate packages use domain names 65 | it('rejects http://127.0.0.1:11434 in production', () => { 66 | process.env.NODE_ENV = 'production' > 67 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://127.0.0.1:11434'))).toBe( 68 | 'private_ip_literal', 69 | )
HTTP request to raw IP address — legitimate packages use domain names 77 | 78 | it('rejects 169.254.169.254 (cloud metadata)', () => { > 79 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://169.254.169.254/'))).toBe( 80 | 'private_ip_literal', 81 | )
HTTP request to raw IP address — legitimate packages use domain names 83 | 84 | it('rejects RFC1918 10/8', () => { > 85 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://10.0.0.5/'))).toBe( 86 | 'private_ip_literal', 87 | )
HTTP request to raw IP address — legitimate packages use domain names 89 | 90 | it('rejects RFC1918 172.16/12', () => { > 91 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://172.16.0.1/'))).toBe( 92 | 'private_ip_literal', 93 | )
HTTP request to raw IP address — legitimate packages use domain names 95 | 96 | it('rejects RFC1918 192.168/16', () => { > 97 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://192.168.1.10/'))).toBe( 98 | 'private_ip_literal', 99 | )
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 149 | 150 | it('rejects file:// scheme', () => { > 151 | expect(reasonOf(() => assertSafeOllamaBaseUrl('file:///etc/passwd'))).toBe( 152 | 'forbidden_protocol', 153 | )
HTTP request to raw IP address — legitimate packages use domain names 194 | it('does not accept a non-matching host even with allowlist set', () => { 195 | process.env.OM_SEARCH_OLLAMA_BASE_URL_ALLOWLIST = 'ollama.internal.example.com' > 196 | expect(reasonOf(() => assertSafeOllamaBaseUrl('http://10.0.0.5/'))).toBe( 197 | 'private_ip_literal', 198 | )
HTTP request to raw IP address — legitimate packages use domain names 201 | it('OM_SEARCH_OLLAMA_ALLOW_PRIVATE relaxes private-IP check', () => { 202 | process.env.OM_SEARCH_OLLAMA_ALLOW_PRIVATE = 'true' > 203 | expect(() => assertSafeOllamaBaseUrl('http://10.0.0.5/')).not.toThrow() 204 | }) 205 |
Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 222 | it('OM_SEARCH_OLLAMA_ALLOW_PRIVATE still enforces scheme allowlist', () => { 223 | process.env.OM_SEARCH_OLLAMA_ALLOW_PRIVATE = 'true' > 224 | expect(reasonOf(() => assertSafeOllamaBaseUrl('file:///etc/passwd'))).toBe( 225 | 'forbidden_protocol', 226 | )
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.6.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.