Skip to content

R Magrittr Pipe Chain Leading to eval Code Injection #1976

@rwmcintosh

Description

@rwmcintosh

CWE-95

Description

This rule detects cases where user-supplied input is passed through a pipe chain and ultimately evaluated by R's eval() function. When untrusted data reaches eval(), an attacker can craft malicious strings that get executed as arbitrary R code within the application's runtime environment.

This presents a critical security risk because eval() executes any valid R expression, allowing attackers to read or modify files, exfiltrate sensitive data, execute system commands, or completely compromise the system.

Exploitability (AI-assessed): Non-Exploitable

The eval() call uses bquote() with a .() substitution operator, which safely interpolates the y2UnitValue variable into the expression before evaluation. y2UnitValue is extracted from an internal metaData structure (not user input), and bquote() prevents arbitrary code injection by only substituting the specified variable. This is a safe pattern for constructing ggplot2 aesthetic mappings and does not represent an exploitable code injection vulnerability.

Remediation (if hardening anyway)

Avoid eval() on constructed expressions where practical. Prefer non-evaluating ggplot2 mechanisms (e.g. aes(.data[[col]]) / tidy-eval) over building expressions for eval(). If eval() is required, keep substituting only known internal values via bquote(.()) — never raw strings derived from external input.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    Status
    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions