aws-amplify / aws-amplify/amplify-codegen-ui
Security: Unvalidated dynamic property access in createDataStorePredicate
- Dominant language
- TypeScript
- Stars
- 31
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Description
# AWS Amplify Codegen UI - Unvalidated Dynamic Property Access in createDataStorePredicate
## Summary
The generated `createDataStorePredicate` function performs dynamic property access `p[field][operator]` where `field` and `operator` come from `DataStorePredicateObject` without validation against an allowlist. While the predicate object is typically developer-controlled via Studio config, the lack of validation means any field/operator string is accepted and used in bracket notation access.
## Affected Code
File: `packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts`
Contributor guide
Research direction
Start with packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts and trace how DataStorePredicateObject supplies field and operator. Determine the project’s expected allowlist and validation behavior, then add focused coverage; done means invalid dynamic property inputs are rejected or safely handled before bracket access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, react, typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100