Skip to content

Commit

Permalink
[Flight] Enforce "simple object" rule in production (#27502)
Browse files Browse the repository at this point in the history
We only allow plain objects that can be faithfully serialized and
deserialized through JSON to pass through the serialization boundary.

It's a bit too expensive to do all the possible checks in production so
we do most checks in DEV, so it's still possible to pass an object in
production by mistake. This is currently exaggerated by frameworks
because the logs on the server aren't visible enough. Even so, it's
possible to do a mistake without testing it in DEV or just testing a
conditional branch. That might have security implications if that object
wasn't supposed to be passed.

We can't rely on only checking if the prototype is `Object.prototype`
because that wouldn't work with cross-realm objects which is
unfortunate. However, if it isn't, we can check wether it has exactly
one prototype on the chain which would catch the common error of passing
a class instance.

DiffTrain build for commit e61a60f.
  • Loading branch information
sebmarkbage committed Oct 11, 2023
1 parent 492aa81 commit a892e8a
Show file tree
Hide file tree
Showing 7 changed files with 9 additions and 9 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -24770,7 +24770,7 @@ function createFiberRoot(
return root;
}

var ReactVersion = "18.3.0-canary-1fc58281a-20231011";
var ReactVersion = "18.3.0-canary-e61a60fac-20231011";

// Might add PROFILE later.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8968,7 +8968,7 @@ var devToolsConfig$jscomp$inline_1008 = {
throw Error("TestRenderer does not support findFiberByHostInstance()");
},
bundleType: 0,
version: "18.3.0-canary-1fc58281a-20231011",
version: "18.3.0-canary-e61a60fac-20231011",
rendererPackageName: "react-test-renderer"
};
var internals$jscomp$inline_1201 = {
Expand Down Expand Up @@ -8999,7 +8999,7 @@ var internals$jscomp$inline_1201 = {
scheduleRoot: null,
setRefreshHandler: null,
getCurrentFiber: null,
reconcilerVersion: "18.3.0-canary-1fc58281a-20231011"
reconcilerVersion: "18.3.0-canary-e61a60fac-20231011"
};
if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
var hook$jscomp$inline_1202 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -9394,7 +9394,7 @@ var devToolsConfig$jscomp$inline_1050 = {
throw Error("TestRenderer does not support findFiberByHostInstance()");
},
bundleType: 0,
version: "18.3.0-canary-1fc58281a-20231011",
version: "18.3.0-canary-e61a60fac-20231011",
rendererPackageName: "react-test-renderer"
};
var internals$jscomp$inline_1242 = {
Expand Down Expand Up @@ -9425,7 +9425,7 @@ var internals$jscomp$inline_1242 = {
scheduleRoot: null,
setRefreshHandler: null,
getCurrentFiber: null,
reconcilerVersion: "18.3.0-canary-1fc58281a-20231011"
reconcilerVersion: "18.3.0-canary-e61a60fac-20231011"
};
if ("undefined" !== typeof __REACT_DEVTOOLS_GLOBAL_HOOK__) {
var hook$jscomp$inline_1243 = __REACT_DEVTOOLS_GLOBAL_HOOK__;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ if (
}
"use strict";

var ReactVersion = "18.3.0-canary-1fc58281a-20231011";
var ReactVersion = "18.3.0-canary-e61a60fac-20231011";

// ATTENTION
// When adding new symbols to this file,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -580,4 +580,4 @@ exports.useSyncExternalStore = function (
exports.useTransition = function () {
return ReactCurrentDispatcher.current.useTransition();
};
exports.version = "18.3.0-canary-1fc58281a-20231011";
exports.version = "18.3.0-canary-e61a60fac-20231011";
Original file line number Diff line number Diff line change
Expand Up @@ -583,7 +583,7 @@ exports.useSyncExternalStore = function (
exports.useTransition = function () {
return ReactCurrentDispatcher.current.useTransition();
};
exports.version = "18.3.0-canary-1fc58281a-20231011";
exports.version = "18.3.0-canary-e61a60fac-20231011";

/* global __REACT_DEVTOOLS_GLOBAL_HOOK__ */
if (
Expand Down
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1fc58281af73ca4507c41d53a3e08dc2038b0c1f
e61a60fac02d205ad928bff6de2449f00646a92c

0 comments on commit a892e8a

Please sign in to comment.