AWS Amplify Codegen UI - Unvalidated Dynamic Property Access in createDataStorePredicate
Summary
The generated createDataStorePredicate function performs dynamic property access p[field][operator] where field and operator come from DataStorePredicateObject without validation against an allowlist. While the predicate object is typically developer-controlled via Studio config, the lack of validation means any field/operator string is accepted and used in bracket notation access.
Affected Code
File: packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts
AWS Amplify Codegen UI - Unvalidated Dynamic Property Access in createDataStorePredicate
Summary
The generated
createDataStorePredicatefunction performs dynamic property accessp[field][operator]wherefieldandoperatorcome fromDataStorePredicateObjectwithout validation against an allowlist. While the predicate object is typically developer-controlled via Studio config, the lack of validation means any field/operator string is accepted and used in bracket notation access.Affected Code
File:
packages/codegen-ui-react/lib/utils-file-functions/hooks/createDataStorePredicate.ts