file-browser

This module renders local files and contains no evident credential theft, exfiltration, persistence, or destructive behavior. It has a security concern: renderHtmlView loads HTML files in a same-origin iframe with both allow-scripts and allow-same-origin, which can permit untrusted HTML to execute with application-origin privileges and defeat the intended sandbox. Severity is conditional on untrusted files being renderable and served from the application origin; no specific domains, IPs, or credentials are present.

This module renders Markdown and does not show evidence of malware, credential theft, or unauthorized network activity. It returns unsanitized HTML and preserves protocol-prefixed links, creating an XSS risk if untrusted Markdown is rendered in a browser without sanitization; relative image paths also produce /file/ URLs whose server-side access controls are outside this file. The displayed incomplete string literal would make the source fail to parse if literal. Severity: moderate, conditional on untrusted Markdown and downstream handling.

This code is a file-browser HTTP server and shows no evidence of malware or unauthorized outbound activity. Its main security concern is path confinement: lexical checks can be bypassed through symlinks, and an empty allowedDirs configuration permits unrestricted paths; /assets also bypasses that check. HTML error output is not escaped, and malformed percent encoding may throw during request handling. Severity is configuration- and exposure-dependent; restrict allowedDirs, account for symlinks, and avoid exposing the server to untrusted clients.

This is a command-line file-browser server launcher. Its main security concern is possible shell command injection because the user-controlled --host value reaches execSync() through an interpolated, double-quoted URL; serving from the home directory and binding to 0.0.0.0 can also expose local files if the HTTP-server implementation permits it. No evidence of credential theft, malicious network exfiltration, or other malware appears in this fragment. Severity is moderate; review the HTTP-server access controls and replace shell-based browser launching with a non-shell process API or strict host validation.