zlacker

[parent] [thread] 11 comments
1. coffee+(OP)[view] [source] 2025-12-03 18:58:36
Not quite. This isn’t saying React or Next.js are fundamentally insecure in general.

The problem is this specific "call whatever server code the client asks" pattern. Traditional APIs with defined endpoints don’t have that issue.

replies(2): >>koakum+dr >>j45+bA
2. koakum+dr[view] [source] 2025-12-03 21:10:06
>>coffee+(OP)
You mean call whatever server action the client asks? I don't think having this vulnerability was intentional.
replies(2): >>j45+yM >>lionko+Mc2
3. j45+bA[view] [source] 2025-12-03 21:53:37
>>coffee+(OP)
I’m not asking if it’s fundamentally insecure.

Architecturally there appears to be an increasingly insecure attack surface appearing in JavaScript at large, based on the insecurities in mandatory dependencies.

If the foundation and dependencies of react has vulnerabilities, react will have security issues indirectly and directly.

This explicit issue seems to be a head scratcher. How could something so basic exist for so long?

Again I ask about react and next.js from their perspective or position of leadership in the JavaScript ecosystem. I don’t think this is a standard anyone wants.

Could there be code reviews created for LLMs to search for issues once discovered in code?

replies(1): >>IgorPa+PP
◧◩
4. j45+yM[view] [source] [discussion] 2025-12-03 22:59:23
>>koakum+dr
I don’t think I’ve heard of intentional vulnerabilities?
replies(2): >>morshu+0V >>clucki+qV
◧◩
5. IgorPa+PP[view] [source] [discussion] 2025-12-03 23:22:46
>>j45+bA
To be fair, the huge JavaScript attack surface has ALWAYS been there. JavaScript runs in a really dynamic environment and everything from XSS-onwards has been fundamentally due to why you can do with the environment.

If you remember “mashups” these were basically just using the fact that you can load any code from any remote server and run it alongside your code and code from other servers while sharing credentials between all of them. But hey it is very useful to let Stripe run their stripe.js on your domain. And AdSense. And Mixpanel. And while we are at it let’s let npm install 1000 packages for a single dependency project. It’s bad.

◧◩◪
6. morshu+0V[view] [source] [discussion] 2025-12-03 23:59:05
>>j45+yM
Log4j almost seemed like it
replies(1): >>j45+VT2
◧◩◪
7. clucki+qV[view] [source] [discussion] 2025-12-04 00:02:02
>>j45+yM
xz?
◧◩
8. lionko+Mc2[view] [source] [discussion] 2025-12-04 12:35:33
>>koakum+dr
This is only really fine as long as you have extremely clearly, well defined actions. You need to verify that the request is sane, well-formed, and makes sense for the current context, at the very least.
replies(1): >>koakum+VE2
◧◩◪
9. koakum+VE2[view] [source] [discussion] 2025-12-04 15:27:41
>>lionko+Mc2
You would probably need to do the same if you were writing back-end in Go or something. I don't see how that is conceptually different.
replies(1): >>amluto+6F5
◧◩◪◨
10. j45+VT2[view] [source] [discussion] 2025-12-04 16:44:04
>>morshu+0V
Seems subjective and a personal interpretation.
replies(1): >>morshu+rP3
◧◩◪◨⬒
11. morshu+rP3[view] [source] [discussion] 2025-12-04 21:15:47
>>j45+VT2
I mean yeah
◧◩◪◨
12. amluto+6F5[view] [source] [discussion] 2025-12-05 12:13:31
>>koakum+VE2
As I understand it, RSC is locating the code to run by name, where the name is supplied by the client.

JS/Node can do this via import() or require().

C, C++, Go, etc can dynamically load plugins, and I would hope that people are careful when doing this when client-supplied data. There is a long history of vulnerabilities when dlopen and dlfcn are used unwisely, and Windows’s LoadLibrary has historical design errors that made it almost impossible to use safely.

Java finds code by name when deserializing objects, and Android has been pwned over and over as a result. Apple did the same thing in ObjC with similar results.

The moral is simple: NEVER use a language’s native module loader to load a module or call a function when the module name or function name comes from an untrusted source, regardless of how well you think you’ve sanitized it. ALWAYS use an explicit configuration that maps client inputs to code that it is permissible to load and call. The actual thing that is dynamically loaded should be a string literal or similar.

I have a boring Python server I’ve maintained for years. It routes requests to modules, and the core is an extremely boring map from route name to the module that gets loaded and the function that gets called.

[go to top]