Security: Arbitrary File Write via Unsanitized User Input

[tomaioo]

Summary

Security: Arbitrary File Write via Unsanitized User Input

Problem

Severity: High | File: __fixtures__/rsc-caching/web/src/components/ServerDelayForm/actions.ts:L6

The formAction server action writes user-provided form data directly to a JSON file. The delay value from formData.get('delay') is not sanitized or validated before being interpolated into the JSON string. An attacker could submit a malicious payload containing closing braces and arbitrary JSON (or even JavaScript/JSON injection if the file is parsed unsafely elsewhere), leading to file corruption or potential exploitation if this file is later consumed by a vulnerable parser.

Solution

Sanitize and validate the input delay value before writing it to the file. Ensure it is parsed as a number and use JSON.stringify to safely construct the JSON object instead of string interpolation.

Changes

• __fixtures__/rsc-caching/web/src/components/ServerDelayForm/actions.ts (modified)

[netlify]

👷 Deploy request for cedarjs pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	25578b4

[greptile-apps]

Greptile Summary

This PR makes the RSC caching fixture serialize its delay setting safely.

• Coerces the submitted delay field with Number().
• Replaces raw JSON interpolation with JSON.stringify().
• Logs the coerced value rather than the original form value.
• Does not alter the project architecture described in docs/implementation-docs/2026-03-26-cedarjs-project-overview.md.

Confidence Score: 4/5

The invalid-duration handling should be fixed before merging because crafted values can silently disable or distort the fixture's configured delay.

The serialization change closes raw JSON injection, but the server action does not reject non-finite, negative, or oversized durations before persisting them for use by setTimeout.

fixtures/rsc-caching/web/src/components/ServerDelayForm/actions.ts

Important Files Changed

Filename	Overview
fixtures/rsc-caching/web/src/components/ServerDelayForm/actions.ts	Safely serializes the settings object, but numeric coercion still admits unsupported durations that produce incorrect delay behavior.

_{Reviews (1): Last reviewed commit: "fix(security): arbitrary file write via ..." | Re-trigger Greptile}

[greptile-apps]

Invalid durations remain accepted

When a crafted submission contains a non-finite, negative, or excessively large delay, Number() accepts it without range validation and the stored value becomes null or an unsupported timer duration, causing the requested delay to become zero or execute almost immediately.