react-doctor/url-prefilled-privileged-action

Reading a privileged action from the URL (invite, role, permission, redirect, sharing) and acting on it lets an attacker craft a link that performs that action for a victim.

• Category: Security
• Severity: warn
• Source: oxlint-plugin-react-doctor
• Framework: global
• Enabled when: client (browser-bundled) production source files; server dirs (api/backend/server/middleware/route/functions/lambdas/workers, *.server.*) skipped
• Tags: security-scan
• Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires in client code that reads a privileged action parameter from the URL: searchParams/useSearchParams()/new URLSearchParams(...) .get(...)/.getAll(...) (or searchParams.<name>) for one of userstoinvite, role, permission, sharingaction, invite, admin, next, continue, returnTo, redirect_uri, or callbackUrl. Reads already wrapped in a validating helper (safe*/valid*/sanitiz*/relativ*/allowlist*/whitelist*(...)) are skipped, and benign email/user params are deliberately not matched. FALSE POSITIVE: the value is used only for display/prefill while the actual privileged action is independently authorized and confirmed server-side, or it is immediately validated by a helper whose name the lookbehind did not recognize.

Fix prompt

Use this once validation confirms the diagnostic is real.

Treat URL-sourced invite, role, permission, redirect, and sharing values as untrusted: never auto-run the action from the query string. Require an explicit user confirmation and re-authorize on the server before applying it. For next/returnTo/redirect_uri/callbackUrl, accept only same-origin relative paths (or an exact allowlist) to prevent open redirects, and check role/permission/invite against the actor's real entitlements server-side, not the URL.

Related rules

More Security rules from the rules reference:

• react-doctor/webhook-signature-risk: An inbound webhook handler that acts on the request body without verifying the provider's signature will process forged requests from anyone.
• socket/low-supply-chain-score: A direct dependency's worst Socket security axis (supply chain or vulnerability) scores below the configured minimum — bump it to a patched/healthier release, replace it, or vet it and raise `supplyChain.minScore`
• react-doctor/active-static-asset: A browser-reachable SVG that contains a `<script>` tag or `on*` event handler runs that code in your origin when someone opens it, which can lead to cross-site scripting.
• react-doctor/agent-tool-capability-risk: An AI agent tool that can reach shell, filesystem, or network primitives lets prompt-injected input trigger those actions, because the model treats tool arguments as trusted.
• react-doctor/artifact-baas-authority-surface: Shipping Firebase/Supabase client config with your collection and authorization-field names in a browser bundle hands attackers a map of your data model, which is dangerous when server-side rules do not enforce access.