itinance / itinance/react-native-fs

[Android] Potential Vulnerabilities Detected by Veracode

Open
#671 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
5k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

When my company made use of react-native-fs, our Application Security scan through Veracode identified the following potential vulnerabilities with the Uploader functionality. We don't actively make use of the Uploader, but I did want to present that to the repository for a potential remediation:

Version 2.12.1

Uploader.java lines 93 and 122 `File file = new File(map.getString("filepath"));`

**Description**: This call to java.io.File.!operator_javanewinit() contains a path manipulation flaw. The argument to the function is a filename constructed using untrusted input. If an attacker is allowed to specify all or part of the filename, it may be possible to gain unauthorized access to files on the server, including those outside the webroot, that would be normally be inaccessible to end users. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to !operator_javanewinit() contains tainted data from the variable getString(). The tainted data originated from earlier calls to com.reactnativecommunity.webview.RNCWebViewManager$RNCWebViewClient.onReceivedError, com.reactnativecommunity.webview.RNCWebViewManager$RNCWebViewClient.onPageFinished, and com.reactnativecommunity.webview.RNCWebViewManager$RNCWebViewClient.onPageStarted.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.