[Security] Harden campaign WebUI dynamic regex and path assignment helpers #53

New Issue

zemion · 2026-07-11T12:51:21+02:00

zemion commented

2026-07-11 12:51:21 +02:00

Semgrep flags dynamic regex construction and prototype-pollution patterns in campaign WebUI helpers. Some regex inputs are escaped, but path assignment should explicitly block prototype keys.

Classification: frontend security hardening.

Report evidence:

bulkImport.ts:754 dynamic separator regex.
templatePlaceholders.ts:215, :221 dynamic placeholder regex.
campaignView.ts:185 nested path read; likely false positive but should be reviewed.
draftEditor.ts:60 nested path write; should block __proto__, prototype, and constructor path segments.

Suggested next steps:

Replace dynamic split regex with deterministic character scanning where practical.
Add isSafePathSegment validation for nested writes.
Add regression tests for prototype-pollution keys and long wildcard/placeholder inputs.
Keep narrow annotations only for escaped regex call sites after tests exist.

Baseline report directory: audit-reports/govoplan-full-20260711-1238

Semgrep flags dynamic regex construction and prototype-pollution patterns in campaign WebUI helpers. Some regex inputs are escaped, but path assignment should explicitly block prototype keys. Classification: **frontend security hardening**. Report evidence: - `bulkImport.ts:754` dynamic separator regex. - `templatePlaceholders.ts:215`, `:221` dynamic placeholder regex. - `campaignView.ts:185` nested path read; likely false positive but should be reviewed. - `draftEditor.ts:60` nested path write; should block `__proto__`, `prototype`, and `constructor` path segments. Suggested next steps: - Replace dynamic split regex with deterministic character scanning where practical. - Add `isSafePathSegment` validation for nested writes. - Add regression tests for prototype-pollution keys and long wildcard/placeholder inputs. - Keep narrow annotations only for escaped regex call sites after tests exist. Baseline report directory: `audit-reports/govoplan-full-20260711-1238`

zemion added the

labels 2026-07-11 12:51:21 +02:00

zemion added the

area/security

audit/structural

source/security-audit

labels 2026-07-11 16:09:33 +02:00

zemion referenced this issue from add-ideas/govoplan

2026-07-11 16:14:03 +02:00

[Audit] Burndown: 2026-07-11 full GovOPlaN security and quality report #4

zemion commented

2026-07-11 17:40:30 +02:00

Codex State: done

Summary

Replaced dynamic RegExp cell splitting with separator-set scanning.
Replaced dynamic placeholder replacement regexes with one static placeholder parser and exact target comparison.
Rewrote recipient-address placeholder detection without dynamic regex construction.
Added a prototype-pollution guard for nested draft path updates.

Changed Files

webui/src/features/campaigns/utils/bulkImport.ts
webui/src/features/campaigns/utils/draftEditor.ts
webui/src/features/campaigns/utils/templatePlaceholders.ts

Verification

npm run test:import-utils
npm run test:template-preview
Direct tsc --noEmit over all changed helper files was attempted but blocked by the repository's optional @govoplan/core-webui peer resolution.

Local fix is ready to push.

## Codex State: done ### Summary - Replaced dynamic `RegExp` cell splitting with separator-set scanning. - Replaced dynamic placeholder replacement regexes with one static placeholder parser and exact target comparison. - Rewrote recipient-address placeholder detection without dynamic regex construction. - Added a prototype-pollution guard for nested draft path updates. ### Changed Files - `webui/src/features/campaigns/utils/bulkImport.ts` - `webui/src/features/campaigns/utils/draftEditor.ts` - `webui/src/features/campaigns/utils/templatePlaceholders.ts` ### Verification - `npm run test:import-utils` - `npm run test:template-preview` - Direct `tsc --noEmit` over all changed helper files was attempted but blocked by the repository's optional `@govoplan/core-webui` peer resolution. Local fix is ready to push.

zemion closed this issue

2026-07-11 17:41:05 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: add-ideas/govoplan-campaign#53