From d0d077b9a8b3ee4ba1302699922f18f9cced5c38 Mon Sep 17 00:00:00 2001
From: Talha12Shiekh <tk.shiekh4567@gmail.com>
Date: Thu, 30 Jul 2026 23:21:21 +0500
Subject: [PATCH] fix(security): validate URL search parameter schema before
 store injection (#2319)

---
 .../web/src/components/basic/ReactiveBase.js  | 43 ++++++++++++++++++-
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/packages/web/src/components/basic/ReactiveBase.js b/packages/web/src/components/basic/ReactiveBase.js
index bcf50f7a3..32d6711fb 100644
--- a/packages/web/src/components/basic/ReactiveBase.js
+++ b/packages/web/src/components/basic/ReactiveBase.js
@@ -137,16 +137,55 @@ class ReactiveBase extends Component {
 		let selectedValues = {};
 		let urlValues = {};
 
+		const isValidURLValue = (value) => {
+			if (value === null || value === undefined) return false;
+			const type = typeof value;
+			if (type === 'string' || type === 'number' || type === 'boolean') return true;
+			if (Array.isArray(value)) {
+				return value.every((item) => {
+					const itemType = typeof item;
+					return itemType === 'string' || itemType === 'number' || itemType === 'boolean';
+				});
+			}
+			if (type === 'object' && value.constructor === Object) {
+				return Object.values(value).every((item) => {
+					const itemType = typeof item;
+					return itemType === 'string' || itemType === 'number' || itemType === 'boolean' || item === null;
+				});
+			}
+			return false;
+		};
+
+		const isValidParsedParam = (parsedParams) => {
+			if (parsedParams === null || parsedParams === undefined) return false;
+			const type = typeof parsedParams;
+			if (type === 'string' || type === 'number' || type === 'boolean' || Array.isArray(parsedParams)) {
+				return true;
+			}
+			if (type === 'object' && parsedParams.constructor === Object) {
+				if (Object.prototype.hasOwnProperty.call(parsedParams, 'value')) {
+					return isValidURLValue(parsedParams.value);
+				}
+				return isValidURLValue(parsedParams);
+			}
+			return false;
+		};
+
 		Array.from(params.keys()).forEach((key) => {
 			try {
 				const parsedParams = JSON.parse(params.get(key));
+				if (!isValidParsedParam(parsedParams)) {
+					return;
+				}
 				const selectedValue = {};
-				if (parsedParams.value) {
+				if (parsedParams && typeof parsedParams === 'object' && Object.prototype.hasOwnProperty.call(parsedParams, 'value')) {
 					selectedValue.value = parsedParams.value;
 				} else {
 					selectedValue.value = parsedParams;
 				}
-				if (parsedParams.category) selectedValue.category = parsedParams.category;
+				if (parsedParams && parsedParams.category && typeof parsedParams.category === 'string') {
+					selectedValue.category = parsedParams.category;
+				}
 				selectedValue.reference = 'URL';
 				selectedValues = {
 					...selectedValues,