security: user-controlled URL params injected directly into Redux store via JSON.parse
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript, react
Research direction
Start in packages/web/src/components/basic/ReactiveBase.js at lines 140-162 and inspect how URL parameters are parsed before entering selectedValues. Validate that parsed values are string primitives or objects with value and category, rejecting other shapes. Done means valid parameters still populate the Redux state while crafted or malformed structures are ignored.
Written by the indexing model from the issue text.
Description
Problem
ReactiveBase.js parses URL search parameters directly with JSON.parse and injects the result into the Redux store as initial selectedValues:
Array.from(params.keys()).forEach((key) => {
try {
const parsedParams = JSON.parse(params.get(key));
selectedValues[key] = { value: parsedParams.value || parsedParams, ... };
} catch (e) { /* silent failure */ }
});
A crafted URL can inject arbitrary object structures into the store, potentially triggering unexpected behavior in downstream components that consume selectedValues.
Location
packages/web/src/components/basic/ReactiveBase.js, lines 140-162
Suggested Fix
Validate the shape of parsed values before injection. Expected shapes are string primitives or { value, category } objects. Reject anything that doesn't match.
Severity
High — URL injection into application state
- Dominant language
- JavaScript
- Stars
- 4.9k
- Forks
- 480
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from appbaseio/reactivesearch
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
appbaseio/reactivesearch#2322 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
appbaseio/reactivesearch#2321 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
appbaseio/reactivesearch#2324 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
appbaseio/reactivesearch#2323 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
appbaseio/reactivesearch#2320 ·
All issues in appbaseio/reactivesearch
Similar issues
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 92/100
PedestrianDynamics/pyFDS-Evac#476 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
aiko-chan-ai/DiscordBotClient#380 ·
-
Offisielle trærOpen
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 3 days
-
Add: Atlas TVOpenchannels:add check:passed
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 4 days