aws-amplify / aws-amplify/amplify-codegen-ui
Security: Unsanitized code injection in buildConditionalExpression (CVE-2025-4318 sibling)
- Dominant language
- TypeScript
- Stars
- 31
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
# AWS Amplify Codegen UI - Unsanitized Code Injection in buildConditionalExpression (CVE-2025-4318 Sibling)
## Summary
The `buildConditionalExpression` function in `react-component-render-helper.ts` passes user-controlled `property` and `field` values from `ConditionalStudioComponentProperty.condition` directly to `factory.createIdentifier()` without calling `escapePropertyValue()` or any sanitization. This is the same vulnerability class as CVE-2025-4318 (GHSA-hf3j-86p7-mfw8) but in a different code path that was missed by all three fix commits.
## Affected Code
File: `packages/codegen-ui-react/lib/react-component-render-helper.ts`, lines 615-647
Contributor guide
Research direction
Inspect packages/codegen-ui-react/lib/react-component-render-helper.ts at lines 615-647, starting with buildConditionalExpression and its handling of property and field values. Confirm that values from ConditionalStudioComponentProperty.condition are safely handled before identifier creation, and verify the vulnerability is covered by appropriate tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react, typescript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100