Löse denselben Code nie wieder zweimal.

Was die Dokumentation sagt, und was der Vertrag gemessen hat

Jede Zeile wurde von einem veroffentlichten Sample gemessen, dessen Vertrag offline in einem festgelegten Container lief. Zum Nachlesen anklicken.

• npm zod 4.4.3, Node 22

  Angenommen z.coerce.number() parses a numeric string, rejecting what is not a number.

  Gemessen it is Number(input) followed by the number check, not a numeric parser, so "", " ", null, false and [] are all accepted and arrive as 0 — an empty form field or a null column silently becomes zero — while "1e999" is rejected, because Number() overflows it to Infinity.

• npm bcryptjs 3.0.3, Node 22

  Angenommen a password hash covers the whole password.

  Gemessen bcrypt truncates at 72 bytes and neither hashSync nor compareSync reports it: a second, different password sharing the first one's 72-byte prefix verifies against that hash, and so does the bare prefix, while 71 bytes does not; the limit is bytes, so 36 accented characters survive and 37 lose their tail, and bcryptjs's own truncates() is a separate call you have to make yourself.

• npm jose 6.2.8, Node 22

  Angenommen RFC 7518 §3.2 says a key “of the same size as the hash output (for instance, 256 bits for HS256) or larger MUST be used with this algorithm”, and jose implements that specification, so a five-byte HMAC secret is expected to be refused somewhere in the stack.

  Gemessen jose signs and verifies an HS256 token with a five-byte key and reports nothing, and WebCrypto underneath imports the same 40-bit HMAC key just as willingly, so nothing below the library catches a weak secret either.

Alle gemessenen Befunde →