push on the history object returned by createBrowserHistory can allow arbitrary JS execution

[zeusdeux]

Hey folks!

If the input given to push is not sanitized, arbitrary JS can be executed in the user's context.
We came across this issue originally in @reach/router but the same seems to exist in this package.

The iOS 100 pushState calls limit fix is what causes this.
The browser correctly throws when the url given to pushState or replaceState contains javascript: which is caught by this catch clause causing window.location.assign to be used to update the url. This call isn't safe with unsanitized input and causes execution of JS.

But why not sanitize your input you might ask? Sure. We missed a spot and have fixed it on our end.
Nevertheless, the push behaviour here circumvents the browser's security system and hence this report.

Codesandbox with the reproduction

[adrianzielonka]

@chaance we're currently using react-router v6 within a production SPA and this is listed as a vulnerability by our code scanning tool Sonatype Nexus IQ due to it being a transient dependency of react-router. Is there any plan to remediate this issue?

[RundaScath]

I recently started using AuditJS and scanning my Ract18 libraries. I found this library is being flagged for Cross-Site Scripting (XSS) as mentioned by @zeusdeux in December of last year ...

pkg:npm/history@5.3.0 - 1 vulnerability found!

  Vulnerability Title:  [sonatype-2021-0015] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  ID:  sonatype-2021-0015
  Description:  history - Cross-Site Scripting (XSS)
  
  The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
  CVSS Score:  6.1
  CVSS Vector:  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  Reference:  https://ossindex.sonatype.org/vulnerability/sonatype-2021-0015?component-type=npm&component-name=history&utm_source=auditjs&utm_medium=integration&utm_content=4.0.37

Like @adrianzielonka asked back in April, is there any work being done to remediate this?

[mickelsonmichael]

Couple years down the road on this, any update on this one? It is still being flagged by the Sonatype IQ Server as of v5.3.0

[zeusdeux]

I found a vulnerability 1y before any tools found it?

I am now Bot.

[praneybehl]

Did anyone manage to resolve the Sonatype IQ Server flag? @mickelsonmichael @RundaScath @adrianzielonka @zeusdeux