ActionTaint: Framework-Aware Taint Analysis for Next.js Server Actions

Abstract

Next.js Server Actions simplify full-stack application development by allowing server-side functions to be called directly from UI components. While these functions may appear as regular JavaScript functions, the framework can expose them as client-accessible server endpoints, creating hidden trust boundaries that are invisible to traditional static analysis. As a result, existing JavaScript analyzers often fail to recognize Server Action inputs as client-accessible, leading to missed security flows that are embedded in the source. This paper introduces ActionTaint, a framework-based static analysis prototype that reconstructs client-accessible Server Actions, models them as explicit client-server trust boundaries, and automatically generates CodeQL taint specifications. Rather than implementing a new taint engine, ActionTaint serves as a semantic adapter between the Next.js framework semantics and CodeQL's inter-procedural taint analysis. Evaluation on synthetic benchmarks, project-like benchmarks, real open-source applications, and seeded vulnerability experiments shows that Server Action's open access modeling allows for the detection of SQL injection, SSRF, path traversal, open redirection, and authorization-related flows that are not visible in standard CodeQL.