github / github/codeql

[False negative] Insufficient identification of React router location prop

オープン
#5,592 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
acknowledged enhancement JS
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

**Description of the issue**
The QL library in [React.qll](https://github.com/github/codeql/blob/main/javascript/ql/src/semmle/javascript/frameworks/React.qll) implements some logic to infer whether a React component is using a `location` prop which is passed by the react-router and marks it as tainted. As far as I understand, the logic is based on whether `useLocation()` is used or if the component imports `react-router`. However, since neither of the above is necessary in order for a component to use the location prop passed by the router this may lead to cases where the dataflow into such components is missed.

As an example, consider and component which is routed and simply uses the location prop as `this.props.location`.

**Mitigation**
An additional way to detect whether a location prop is passed by the router is to detect whether the component analyzed is used in a `Route` JSX element. This provides a reliable way to detect whether the location prop is coming from the router.

The following is a quick-and-dirty example on such an implementation. It can definitely be improved to include more component types and maybe other heuristics for when the name of the component is not available.
```
predicate isComponentRouted(ES2015Component component) {
exists(JSXElement el |
el.getName() = "Route" and
el.getAttributeByName("component").getValue().toString() = component.getName()
)
}

class ImprovedLocationSource extends DOM::LocationSource::Range {
ImprovedLocationSource() {
exists(ES2015Component component |
isComponentRouted(component) and
this = component.getAPropRead("location")
)
}
}
```
Does something like the above make sense as an enhancement to the current implementation or am I missing some aspect of this that may result in increasing the false positive rate?

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。