GHSA-2w86-xfrc-g85r: SQL Injection
Summary
orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node.
Details
ts export const getOpResponseMock = (...): Thing => ({'x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y': faker...., ...overrideResponse});
Safe elsewhere: the zod schema double-quotes the property name; the TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.
PoC
reproduce.sh (+ makespec.py) attached: a property name x': 0, [require("fs").writeFileSync("<marker>","")]: 0, 'y -> mock object literal; calling the mock factory writes the marker. Verified on 8.19.0.
Impact
JavaScript / OS command execution (via childprocess) on the machine of anyone who generates orval mocks from an attacker controlled spec and runs them (tests / MSW).
Suggested fix
Escape the property name for the JS string key (JSON.stringify), and never interpolate a raw property name adjacent to [ ] in object-literal position.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
When emitting mock factory object-literals for schema properties (output.mock: true), escape each property name used as a quoted JS object key (e.g., JSON.stringify) so embedded quotes (') cannot break out of the string and create an injected computed property key [expr]. Never interpolate a raw property name adjacent to [ ] in object-literal position.
JavaScript object-literal key generation in orval mock factory (output.mock: true) object-literal property key emission = escape property name for JS string key (e.g., JSON.stringify) and avoid placing raw property name next to [ ] in object-literal context
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who generate MSW mocks with orval by enabling output.mock: true are exposed if they process an attacker-controlled API specification and later execute the generated mock factory, such as in tests or MSW handlers. The reported impact is code execution on the machine running those generated mocks.
What does an attacker need to control to exploit it?
The attacker needs control over a schema property name in the API specification. A property name containing a single quote can break out of the generated single-quoted object key and inject a computed property expression that is evaluated when the mock factory is called.
Are all generated outputs affected?
The issue is described specifically in generated MSW mocks. The provided information says Zod schema generation double-quotes the property name, while TypeScript interface generation treats the key as a type and is described as a denial-of-service concern rather than this code-execution path.
What can be done if patching is not immediately possible?
Do not generate or execute MSW mocks from untrusted API specifications. As a temporary control, review or reject schema property names containing single quotes before running generated mock factories.
How can I determine whether generated mocks may already be dangerous?
Inspect generated MSW mock factory source for schema-derived property names emitted as single-quoted object keys, especially names containing a single quote followed by object-literal syntax such as a computed key. The proof of concept triggers when calling the generated factory, so generated code should be reviewed before test or handler execution.