Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE Vulnerability in React and Next.js

github.com

Post reply on HN
Print view View original

271–276 of 276 posts

Re: RCE Vulnerability in React and Next.js

#271

Post by [deleted] »

steve_adams_86 wrote: post #261
ashishb wrote: post #250

Earlier quoted context omitted.

> If you use deno you can consume dependencies much more securely How would Deno have prevented the RCE issue with React+Next.js?

It wouldn't. I was responding to your concerns about the TypeScript ecosystem more generally. You avoid the RCE by recognizing that React—and more recently Vercel's—management is a bit of a tire fire, and you should choose better tools with more responsible maintainers. Part of what bothers me about this situation is that React appears to be a view library, and to many people using it that is what it functions as...…

[deleted]

Re: RCE Vulnerability in React and Next.js

#272

Post by bartread »

morshu9001 wrote: post #256
bartread wrote: post #239

Earlier quoted context omitted.

> You don't think the rewrite to TS did not bring any value? I mean, I don't really like TypeScript, and I never have. It's ugly, boilerplatey, and inelegant. I am not a fan. So... no. But, again, some battles you have to accept you've lost. TS is everywhere and there's not much getting away from it.

I think JS is still overall more popular than TS, but if your team forces TS then yeah. It's like Java devs reluctantly switched to JS and were like, this needs more boilerplate.

Yeah, I spent years in Java and then even longer in .NET and it felt like everything I was getting a bit fed up of in those worlds had invaded JS. 20 years ago I could never have imagined defending JS as a language but, as time wore on, I started to appreciate its more stripped back syntax. And then a lot of what’s been added in later ES standards has been great so it seems even more unnecessary to layer TS on top.

Re: RCE Vulnerability in React and Next.js

#273

Post by alisonkisk »

j45 wrote: post #89
coffeecoders wrote: post #41

Earlier quoted context omitted.

Not quite. This isn’t saying React or Next.js are fundamentally insecure in general. The problem is this specific "call whatever server code the client asks" pattern. Traditional APIs with defined endpoints don’t have that issue.

I’m not asking if it’s fundamentally insecure. Architecturally there appears to be an increasingly insecure attack surface appearing in JavaScript at large, based on the insecurities in mandatory dependencies. If the foundation and dependencies of react has vulnerabilities, react will have security issues indirectly and directly. This explicit issue seems to be a head scratcher. How could something so basic exist for…

It's essentially impossible to deploy a non trivial NodeJS (including NextJS, Vercel, React, etc) project without critical vulnerabilities that npm will warn explicitly warn you about but be unable to avoid due to dependency hell of many packages depending unmaintained garbage that pins vulnerable versions of other packages.

Re: RCE Vulnerability in React and Next.js

#274

Post by morshu9001 »

bartread wrote: post #272
morshu9001 wrote: post #256

Earlier quoted context omitted.

I think JS is still overall more popular than TS, but if your team forces TS then yeah. It's like Java devs reluctantly switched to JS and were like, this needs more boilerplate.

Yeah, I spent years in Java and then even longer in .NET and it felt like everything I was getting a bit fed up of in those worlds had invaded JS. 20 years ago I could never have imagined defending JS as a language but, as time wore on, I started to appreciate its more stripped back syntax. And then a lot of what’s been added in later ES standards has been great so it seems even more unnecessary to layer TS on top.

It took me a while to appreciate JS too. Thought it was just the beginner language until I used it. Also had to learn the hard way that a web backend is hard to do efficiently without an event loop.

Re: RCE Vulnerability in React and Next.js

#275

Post by lobito25 »

switz wrote: post #38
dzonga wrote: post #24

till this day, I don't know the substantial benefits of React Server Components over say classically rendered html pages + using htmx ? mind you react in 2017 paid my rent. now cz of the complexity I refuse to work with react.

They lend you optionality of when and where you want your code to run. Plus it enables you to define the server/client network boundary where you see fit and cross that boundary seamlessly. It's totally fine to say you don't understand why they have benefits, but it really irks me when people exclaim they have no value or exist just for complexity's sake. There's no system for web development that provides the develo…

It also gives you a 10 cve
Post reply on HN