react-navigation / react-navigation/react-navigation
react-navigation/core 7.20 decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input from query-string
Open
Nobody has claimed this yet.
bug
needs repro
- Dominant language
- TypeScript
- Stars
- 24.5k
- Forks
- 5.1k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 18
Description
Current behavior
Expected behavior
no fix available its vurnabilities.
Reproduction
https://github.com/react-navigation/react-navigation/tree/main/packages/core
Platform
- Android
- iOS
- Web
- Windows
- MacOS
Packages
- @react-navigation/bottom-tabs
- @react-navigation/drawer
- @react-navigation/material-top-tabs
- @react-navigation/stack
- @react-navigation/native-stack
- react-native-drawer-layout
- react-native-tab-view
Environment
- [] I've removed the packages that I don't use
| package | version |
|---|---|
| @react-navigation/native | |
| @react-navigation/bottom-tabs | |
| @react-navigation/drawer | |
| @react-navigation/material-top-tabs | |
| @react-navigation/stack | |
| @react-navigation/native-stack | |
| react-native-drawer-layout | |
| react-native-tab-view | |
| react-native-screens | |
| react-native-safe-area-context | |
| react-native-gesture-handler | |
| react-native-reanimated | |
| react-native-pager-view | |
| react-native | |
| expo | |
| node | |
| npm or pnpm |
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in packages/core and inspect how query-string input reaches decode-uri-component. Reproduce the malformed percent-encoded input described in the issue, then trace the decoding behavior and existing coverage. Done means the denial-of-service behavior is mitigated and the affected package has a regression check.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile-dev, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100