ReactAppScan: Mining React Application Vulnerabilities via Component Graph
Zhiyong Guo, Mingqing Kang, Venkat N. Venkatakrishnan, Rigel Gjomemo, Yinzhi Cao · 2024
React, a single-page application framework, has recently become popular among web developers due to its flexible and convenient management of web application states via a syntax extension to JavaScript, called JSX (JavaScript and XML). Despite its abundant functionalities, the security of React, especially vulnerability detection, still lags: many existing vulnerability detection works do not support JSX let alone React Data Flow introduced by React components. The only exception is CodeQL, which supports JSX syntax. However, CodeQL cannot properly track React Data Flow across different components for detecting vulnerabilities.