fix: high CPU usage on opening tarp #9390

[duttarnab]

closes #9390

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the handling of data changes and updating the UI based on the data retrieved from the browser's local storage, with a review of potential security vulnerabilities, such as data validation, secure storage, and privilege escalation.

Expand for full summary

Summary:

The code changes in this pull request are focused on improving the handling of data changes and updating the UI based on the data retrieved from the browser's local storage. The changes include introducing state variables to track data changes, conditional rendering of UI components, and notification mechanisms to inform the parent component about data modifications.

From an application security perspective, the changes do not introduce any obvious security vulnerabilities. However, there are a few areas that should be reviewed to ensure the overall security of the application:

1. Data Validation: Ensure that the data retrieved from the local storage is properly validated and sanitized before being used in the UI components to prevent potential injection attacks, such as Cross-Site Scripting (XSS).
2. Secure Storage: Verify that the sensitive information stored in the browser's local storage, such as login details, is stored securely and that appropriate access controls are in place to prevent unauthorized access or modification.
3. Privilege Escalation: Ensure that the extension has the necessary permissions to interact with the browser's local storage and that the data access is limited to only what is required for the application's functionality.

Additionally, the changes in the AuthFlowInputs, RegisterClient, OIDCClients, and UserDetails components also introduce security-relevant aspects that should be reviewed, such as handling of additional parameters, ACR values, token storage, and sensitive data display.

Files Changed:

1. demos/jans-tarp/src/options/options.tsx: The changes focus on improving the handling of data changes and updating the UI based on the data retrieved from the browser's local storage.
2. demos/jans-tarp/src/options/authFlowInputs.tsx: The changes introduce a new prop notifyOnDataChange and handle the OAuth 2.0 authorization code grant type, which should be reviewed for potential security issues.
3. demos/jans-tarp/src/options/registerClient.tsx: The changes focus on the OIDC client registration process, including logging, issuer validation, and storing client information, which are critical for the application's security.
4. demos/jans-tarp/src/options/oidcClients.tsx: The changes are related to the OIDC Clients functionality, including deleting OIDC clients and triggering the authentication flow, which should be reviewed for security implications.
5. demos/jans-tarp/src/options/userDetails.tsx: The changes handle the display of sensitive user data, such as access tokens and ID tokens, which should be reviewed to ensure proper data handling and security.

Code Analysis

We ran 9 analyzers against 5 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.