how to fix codacy alert "Generic Object Injection Sink"

Question

Below is my code. I don't think there is any problem.

How can I fool codacy? If I can't use obj[key], then what the hell is this thing? There is no way I can avoid [].

handleClick = (e, titleProps) => {
     const { index } = titleProps
     const newVal = this.state.activeIndexObj[index]? false: true
     let activeIndexObj = {...this.state.activeIndexObj}
     activeIndexObj[index] = newVal
     // Generic Object Injection Sink (security/detect-object-injection)

Possible duplicate of [Why is it bad pratice calling an array index with a variable?](https://stackoverflow.com/questions/44882542/why-is-it-bad-pratice-calling-an-array-index-with-a-variable) — Luca Kiebel, Aug 06 '18 at 21:07

score 19 · Answer 1 · answered Apr 16 '19 at 06:08

19

You just need to parse index into integer

activeIndexObj[parseInt(index)] = newVal

there could be chances hacker may inject function or prototype chaining so that's why this security error comes.

answered Apr 16 '19 at 06:08

viveksharma

557
4
9

Your amazing ! Brilliant idea – Antoine Draune Oct 22 '19 at 19:40
4

Unfortunately this brings a type script error: TS2345: Argument of type 'number' is not assignable to parameter of type 'string'. My index is of type number, but security error is thrown. – Carsten Ennulat Sep 14 '21 at 08:44

score 0 · Answer 2 · answered Aug 07 '18 at 08:45

the question linked on the comment by @luca (Why is it bad pratice calling an array index with a variable?) explains the problem with using a variable to access an array index. It's a security question.

If you allow a non validated input to be used as an array index, your application may crash. Even if you validate the index, it's a matter of time until you refactor the code and the validation be skipped. Hence the recommendation to avoid such code. One recommended solution is to use a Map: https://stackoverflow.com/a/44882765/4398050

If you don't wanna know about this problem, it is possible to ignore the issue in the codacy UI: https://support.codacy.com/hc/en-us/articles/207279979-Issues#2-remove-pattern

The answer in "Why is it bad practice calling an array index with a variable" does not make sense at all. I think the answer is wrong. — Nicolas S.Xu, Aug 07 '18 at 15:44
well, in the codacy UI there are links explaining the issue, have a look by yourself: https://github.com/nodesecurity/eslint-plugin-security#detect-object-injection — pedrorijo91, Aug 07 '18 at 15:51

how to fix codacy alert "Generic Object Injection Sink"

2 Answers2

Linked