171–180 of 276 posts
Earlier quoted context omitted.
No. You cannot find all vulnerable code by grepping for ”use server”, for instance.
I'm sorry, but you're incorrect. That is genuinely how this CVE works. All (and only) code with "use server" was vulnerable.
> Even if your app does not implement any React Server Function endpoints it may still be vulnerable if your app supports React Server Components.
Earlier quoted context omitted.
Given that the fix appears to be to look for own properties, the attack was likely to reference prototype level module properties or the gift-that-keeps-giving the that is __proto__.
I see this type of vulnerability all the time. Seen it in Java, Lua, JavaScript, Python and so on. I think deserialization that relying on blacklists of properties is a dangerous game. I think rolling your own object deserialization in a library that isn’t fully dedicated to deserialization is about as dangerous as writing your own encryption code.
I like React, a lot. But it looks to me that RSC is not something I would use in an offline-first application anyway, is that right?
I have built electron apps for fun that utilize React Server Components entirely offline.
Is there some sort of example exploit somewhere?
Is there some sort of example exploit somewhere?
Why does the react development team keeps investing their time on confusing features that only reinvent the wheel and cause more problems than solve? What does server components do so much better than SSR? What minute performance gain is achieved more than client side rendering? Why won’t they invest more on solving the developer experience that took a nosedive when hooks were introduced? They finally added a compile…
I couldn't agree more. I'll probably switch from React to something like ArrowJS in my personal work: https://www.arrow-js.com/docs/ It makes it easy to have a central JSON-like state object representing what's on the page, then have components watch that for changes and re-render. That avoids the opaqueness of Redux and promise chains, which can be difficult to examine and debug (unless we add browser extensions for…
yea? JSX is much more than templating.
Earlier quoted context omitted.
The endpoint is not whatever the client asks for. It's marked specifically as exposed to the user with "use server". Of course the people who designed this recognize that this is designing an RPC system. A similar bug could be introduced in the implementation of other RPC systems too. It's not entirely specific to this design. (I contribute to React but not really on RSC.)
”use server” is not required for this vulnerability to be exploitable.
am I also vulnerable??????
I like React, a lot. But it looks to me that RSC is not something I would use in an offline-first application anyway, is that right?