General issue: XSS vulnerabilities (CWE-79/CWE-116) not detected in React/Next.js .tsx components
- Lingua principale
- CodeQL
- Stelle
- 10.1k
- Fork
- 2.1k
- Merge medio
- 2g 15h
- PR unite (30g)
- 141
Descrizione
**Description**
I am testing the CodeQL accuracy by seeding different types of XSS vulnerabilities and running the advanced workflow with security-extended and security-and-quality queries. I noticed an issue with CodeQL flagging vulnerabilities in .tsx files. While the seeded code is detected as expected in route.ts, it is not in the component files. In both cases, at least CWE-79 should be noted.
**Setup**
- GitHub Advanced Security enabled on a public test repo
- Language: typescript
- Framework: Next.js
- CodeQL initialized with codeql/javascript-queries and security-extended,security-and-quality
**Workflow file**
```
name: "CodeQL Advanced"
on:
push:
branches: ["main", "security/*"]
pull_request:
branches: ["main", "dev"]
jobs:
analyze:
name: Analyze (${{ matrix.language }})
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
permissions:
security-events: write
packages: read
actions: read
contents: read
strategy:
fail-fast: false
matrix:
include:
- language: actions
- language: javascript-typescript
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
queries: security-extended,security-and-quality
packs: codeql/javascript-queries
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4
with:
category: "/language:${{matrix.language}}"
```
**Reference**
https://github.com/aniakowalewska1/migration-playground/pull/39
**Expected CWEs that are not detected, but are present in documentation (https://codeql.github.com/codeql-query-help/javascript-cwe/)**
CWE-79
```tsx
export default function Seed({ msg }: { msg: string }) {
return (
Seed XSS page
);
}
```
CWE-20/CWE-116
```tsx
export async function getServerSideProps(context: GetServerSidePropsContext) {
const { query } = context;
const msg = query?.msg ?? "";
return { props: { msg } };
}
```
CWE-79
```tsx
export default function TestPage({ userInput }: TestPageProps) {
return ;
}
```
CWE-20/CWE-601
```tsx
export async function getServerSideProps(context: GetServerSidePropsContext) {
return { props: { userInput: context.query.content || "" } };
}
```
CWE-79
```tsx
```
CWE-116
```tsx
const userInput =
userContent || "Hello";
```
**Questions**
- Is there additional setup needed for scanning React?
- Why is CWE-79 and CWE-116 flagged is a .ts file and ignored in .tsx?
Guida per i contributori
Apri la guida per i contributori
Direzione di ricerca
Riproduci il report con il workflow GitHub Actions mostrato, confrontando i risultati di route.ts predisposti con gli esempi di componenti .tsx. Inizia esaminando codeql/javascript-queries e le selezioni di query security-extended e security-and-quality. Il lavoro è completo quando viene spiegata la differenza di rilevamento tra TypeScript e TSX e viene identificata la modifica necessaria alla query o all’analisi, con verifica rispetto ai casi CWE-79 e CWE-116 elencati.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- github-actions, next.js, react, typescript
- Ambito
- security
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Abbastanza chiara
- Idoneità per principianti
- 38/100