Collected research
ReactAppScan: Mining React Application Vulnerabilities via Component Graph
Existing web vulnerability scanners do not model React Data Flow, the indirect passing of data between components via props and state, and CodeQL's coarse object representation misses it as well. This work builds a Component Graph by abstract interpretation over React component lifecycles, then queries source-to-sink paths - requests reaching sinks such as dangerouslySetInnerHTML - including flows that span client and server. It reports 61 zero-day vulnerabilities in real applications.
Record
- Researcher
- Zhiyong Guo, Mingqing Kang, V.N. Venkatakrishnan, Rigel Gjomemo and Yinzhi Cao
- Published by
- yinzhicao.org
- Format
- Whitepaper
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Zhiyong Guo, Mingqing Kang, V.N. Venkatakrishnan, Rigel Gjomemo and Yinzhi Cao, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .