aws-amplify / aws-amplify/amplify-codegen-ui

Security: Unvalidated dynamic property access in createDataStorePredicate

Open
#1,206 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
31
Forks
30
PR merge metrics
No merged PRs in 30d

Description

# AWS Amplify Codegen UI - Unvalidated Dynamic Property Access in createDataStorePredicate

## Summary

The generated `createDataStorePredicate` function performs dynamic property access `p[field][operator]` where `field` and `operator` come from `DataStorePredicateObject` without validation against an allowlist. While the predicate object is typically developer-controlled via Studio config, the lack of validation means any field/operator string is accepted and used in bracket notation access.

## Affected Code

File: `packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts`

Contributor guide

Open the contributing guide

Research direction

Start with packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts and trace how DataStorePredicateObject supplies field and operator. Determine the project’s expected allowlist and validation behavior, then add focused coverage; done means invalid dynamic property inputs are rejected or safely handled before bracket access.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, react, typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.