Skip to content

Commit 1068027

Browse files
unstubbablesebmarkbagegnofflubieowoceeps1lon
authored
[Flight] Add more DoS mitigations to Flight Reply, and harden Flight (facebook#35632)
This fixes security vulnerabilities in Server Functions. --------- Co-authored-by: Sebastian Markbåge <sebastian@calyptus.eu> Co-authored-by: Josh Story <josh.c.story@gmail.com> Co-authored-by: Janka Uryga <lolzatu2@gmail.com> Co-authored-by: Sebastian Sebbie Silbermann <sebastian.silbermann@vercel.com>
1 parent 699abc8 commit 1068027

File tree

18 files changed

+835
-263
lines changed

18 files changed

+835
-263
lines changed

‎packages/react-client/src/ReactFlightClient.js‎

Lines changed: 57 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,8 @@ import getComponentNameFromType from 'shared/getComponentNameFromType';
9494

9595
import {getOwnerStackByComponentInfoInDev} from 'shared/ReactComponentInfoStack';
9696

97+
import hasOwnProperty from 'shared/hasOwnProperty';
98+
9799
import {injectInternals} from './ReactFlightClientDevToolsHook';
98100

99101
import {OMITTED_PROP_ERROR} from 'shared/ReactFlightPropertyAccess';
@@ -159,6 +161,8 @@ const INITIALIZED = 'fulfilled';
159161
const ERRORED = 'rejected';
160162
const HALTED = 'halted'; // DEV-only. Means it never resolves even if connection closes.
161163

164+
const __PROTO__ = '__proto__';
165+
162166
type PendingChunk<T> = {
163167
status: 'pending',
164168
value: null | Array<InitializationReference | (T => mixed)>,
@@ -1544,7 +1548,16 @@ function fulfillReference(
15441548
}
15451549
}
15461550
}
1547-
value = value[path[i]];
1551+
const name = path[i];
1552+
if (
1553+
typeof value === 'object' &&
1554+
value !== null &&
1555+
hasOwnProperty.call(value, name)
1556+
) {
1557+
value = value[name];
1558+
} else {
1559+
throw new Error('Invalid reference.');
1560+
}
15481561
}
15491562

15501563
while (
@@ -1580,7 +1593,9 @@ function fulfillReference(
15801593
}
15811594

15821595
const mappedValue = map(response, value, parentObject, key);
1583-
parentObject[key] = mappedValue;
1596+
if (key !== __PROTO__) {
1597+
parentObject[key] = mappedValue;
1598+
}
15841599

15851600
// If this is the root object for a model reference, where `handler.value`
15861601
// is a stale `null`, the resolved value can be used directly.
@@ -1849,7 +1864,9 @@ function loadServerReference<A: Iterable<any>, T>(
18491864
response._encodeFormAction,
18501865
);
18511866

1852-
parentObject[key] = resolvedValue;
1867+
if (key !== __PROTO__) {
1868+
parentObject[key] = resolvedValue;
1869+
}
18531870

18541871
// If this is the root object for a model reference, where `handler.value`
18551872
// is a stale `null`, the resolved value can be used directly.
@@ -2231,29 +2248,31 @@ function defineLazyGetter<T>(
22312248
): any {
22322249
// We don't immediately initialize it even if it's resolved.
22332250
// Instead, we wait for the getter to get accessed.
2234-
Object.defineProperty(parentObject, key, {
2235-
get: function () {
2236-
if (chunk.status === RESOLVED_MODEL) {
2237-
// If it was now resolved, then we initialize it. This may then discover
2238-
// a new set of lazy references that are then asked for eagerly in case
2239-
// we get that deep.
2240-
initializeModelChunk(chunk);
2241-
}
2242-
switch (chunk.status) {
2243-
case INITIALIZED: {
2244-
return chunk.value;
2251+
if (key !== __PROTO__) {
2252+
Object.defineProperty(parentObject, key, {
2253+
get: function () {
2254+
if (chunk.status === RESOLVED_MODEL) {
2255+
// If it was now resolved, then we initialize it. This may then discover
2256+
// a new set of lazy references that are then asked for eagerly in case
2257+
// we get that deep.
2258+
initializeModelChunk(chunk);
22452259
}
2246-
case ERRORED:
2247-
throw chunk.reason;
2248-
}
2249-
// Otherwise, we didn't have enough time to load the object before it was
2250-
// accessed or the connection closed. So we just log that it was omitted.
2251-
// TODO: We should ideally throw here to indicate a difference.
2252-
return OMITTED_PROP_ERROR;
2253-
},
2254-
enumerable: true,
2255-
configurable: false,
2256-
});
2260+
switch (chunk.status) {
2261+
case INITIALIZED: {
2262+
return chunk.value;
2263+
}
2264+
case ERRORED:
2265+
throw chunk.reason;
2266+
}
2267+
// Otherwise, we didn't have enough time to load the object before it was
2268+
// accessed or the connection closed. So we just log that it was omitted.
2269+
// TODO: We should ideally throw here to indicate a difference.
2270+
return OMITTED_PROP_ERROR;
2271+
},
2272+
enumerable: true,
2273+
configurable: false,
2274+
});
2275+
}
22572276
return null;
22582277
}
22592278

@@ -2564,14 +2583,16 @@ function parseModelString(
25642583
// In DEV mode we encode omitted objects in logs as a getter that throws
25652584
// so that when you try to access it on the client, you know why that
25662585
// happened.
2567-
Object.defineProperty(parentObject, key, {
2568-
get: function () {
2569-
// TODO: We should ideally throw here to indicate a difference.
2570-
return OMITTED_PROP_ERROR;
2571-
},
2572-
enumerable: true,
2573-
configurable: false,
2574-
});
2586+
if (key !== __PROTO__) {
2587+
Object.defineProperty(parentObject, key, {
2588+
get: function () {
2589+
// TODO: We should ideally throw here to indicate a difference.
2590+
return OMITTED_PROP_ERROR;
2591+
},
2592+
enumerable: true,
2593+
configurable: false,
2594+
});
2595+
}
25752596
return null;
25762597
}
25772598
// Fallthrough
@@ -5183,6 +5204,9 @@ function parseModel<T>(response: Response, json: UninitializedModel): T {
51835204
function createFromJSONCallback(response: Response) {
51845205
// $FlowFixMe[missing-this-annot]
51855206
return function (key: string, value: JSONValue) {
5207+
if (key === __PROTO__) {
5208+
return undefined;
5209+
}
51865210
if (typeof value === 'string') {
51875211
// We can't use .bind here because we need the "this" value.
51885212
return parseModelString(response, this, key, value);

‎packages/react-client/src/ReactFlightReplyClient.js‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@ export type ReactServerValue =
9595

9696
type ReactServerObject = {+[key: string]: ReactServerValue};
9797

98+
const __PROTO__ = '__proto__';
99+
98100
function serializeByValueID(id: number): string {
99101
return '$' + id.toString(16);
100102
}
@@ -361,6 +363,15 @@ export function processReply(
361363
): ReactJSONValue {
362364
const parent = this;
363365

366+
if (__DEV__) {
367+
if (key === __PROTO__) {
368+
console.error(
369+
'Expected not to serialize an object with own property `__proto__`. When parsed this property will be omitted.%s',
370+
describeObjectForErrorMessage(parent, key),
371+
);
372+
}
373+
}
374+
364375
// Make sure that `parent[key]` wasn't JSONified before `value` was passed to us
365376
if (__DEV__) {
366377
// $FlowFixMe[incompatible-use]
@@ -780,6 +791,10 @@ export function processReply(
780791
if (typeof value === 'function') {
781792
const referenceClosure = knownServerReferences.get(value);
782793
if (referenceClosure !== undefined) {
794+
const existingReference = writtenObjects.get(value);
795+
if (existingReference !== undefined) {
796+
return existingReference;
797+
}
783798
const {id, bound} = referenceClosure;
784799
const referenceClosureJSON = JSON.stringify({id, bound}, resolveToJSON);
785800
if (formData === null) {
@@ -789,7 +804,10 @@ export function processReply(
789804
// The reference to this function came from the same client so we can pass it back.
790805
const refId = nextPartId++;
791806
formData.set(formFieldPrefix + refId, referenceClosureJSON);
792-
return serializeServerReferenceID(refId);
807+
const serverReferenceId = serializeServerReferenceID(refId);
808+
// Store the server reference ID for deduplication.
809+
writtenObjects.set(value, serverReferenceId);
810+
return serverReferenceId;
793811
}
794812
if (temporaryReferences !== undefined && key.indexOf(':') === -1) {
795813
// TODO: If the property name contains a colon, we don't dedupe. Escape instead.

‎packages/react-client/src/forks/ReactFlightClientConfig.markup.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ export function resolveClientReference<T>(
4343

4444
export function resolveServerReference<T>(
4545
config: ServerManifest,
46-
id: ServerReferenceId,
46+
id: mixed,
4747
): ClientReference<T> {
4848
throw new Error(
4949
'renderToHTML should not have emitted Server References. This is a bug in React.',

‎packages/react-server-dom-esm/src/server/ReactFlightDOMServerNode.js‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,12 +328,17 @@ function prerenderToNodeStream(
328328
function decodeReplyFromBusboy<T>(
329329
busboyStream: Busboy,
330330
moduleBasePath: ServerManifest,
331-
options?: {temporaryReferences?: TemporaryReferenceSet},
331+
options?: {
332+
temporaryReferences?: TemporaryReferenceSet,
333+
arraySizeLimit?: number,
334+
},
332335
): Thenable<T> {
333336
const response = createResponse(
334337
moduleBasePath,
335338
'',
336339
options ? options.temporaryReferences : undefined,
340+
undefined,
341+
options ? options.arraySizeLimit : undefined,
337342
);
338343
let pendingFiles = 0;
339344
const queuedFields: Array<string> = [];
@@ -399,7 +404,10 @@ function decodeReplyFromBusboy<T>(
399404
function decodeReply<T>(
400405
body: string | FormData,
401406
moduleBasePath: ServerManifest,
402-
options?: {temporaryReferences?: TemporaryReferenceSet},
407+
options?: {
408+
temporaryReferences?: TemporaryReferenceSet,
409+
arraySizeLimit?: number,
410+
},
403411
): Thenable<T> {
404412
if (typeof body === 'string') {
405413
const form = new FormData();
@@ -411,6 +419,7 @@ function decodeReply<T>(
411419
'',
412420
options ? options.temporaryReferences : undefined,
413421
body,
422+
options ? options.arraySizeLimit : undefined,
414423
);
415424
const root = getRoot<T>(response);
416425
close(response);

‎packages/react-server-dom-parcel/src/server/ReactFlightDOMServerBrowser.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,10 @@ export function registerServerActions(manifest: ServerManifest) {
245245

246246
export function decodeReply<T>(
247247
body: string | FormData,
248-
options?: {temporaryReferences?: TemporaryReferenceSet},
248+
options?: {
249+
temporaryReferences?: TemporaryReferenceSet,
250+
arraySizeLimit?: number,
251+
},
249252
): Thenable<T> {
250253
if (typeof body === 'string') {
251254
const form = new FormData();
@@ -257,6 +260,7 @@ export function decodeReply<T>(
257260
'',
258261
options ? options.temporaryReferences : undefined,
259262
body,
263+
options ? options.arraySizeLimit : undefined,
260264
);
261265
const root = getRoot<T>(response);
262266
close(response);

‎packages/react-server-dom-parcel/src/server/ReactFlightDOMServerEdge.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -250,7 +250,10 @@ export function registerServerActions(manifest: ServerManifest) {
250250

251251
export function decodeReply<T>(
252252
body: string | FormData,
253-
options?: {temporaryReferences?: TemporaryReferenceSet},
253+
options?: {
254+
temporaryReferences?: TemporaryReferenceSet,
255+
arraySizeLimit?: number,
256+
},
254257
): Thenable<T> {
255258
if (typeof body === 'string') {
256259
const form = new FormData();
@@ -262,6 +265,7 @@ export function decodeReply<T>(
262265
'',
263266
options ? options.temporaryReferences : undefined,
264267
body,
268+
options ? options.arraySizeLimit : undefined,
265269
);
266270
const root = getRoot<T>(response);
267271
close(response);

‎packages/react-server-dom-parcel/src/server/ReactFlightDOMServerNode.js‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -556,12 +556,17 @@ export function registerServerActions(manifest: ServerManifest) {
556556

557557
export function decodeReplyFromBusboy<T>(
558558
busboyStream: Busboy,
559-
options?: {temporaryReferences?: TemporaryReferenceSet},
559+
options?: {
560+
temporaryReferences?: TemporaryReferenceSet,
561+
arraySizeLimit?: number,
562+
},
560563
): Thenable<T> {
561564
const response = createResponse(
562565
serverManifest,
563566
'',
564567
options ? options.temporaryReferences : undefined,
568+
undefined,
569+
options ? options.arraySizeLimit : undefined,
565570
);
566571
let pendingFiles = 0;
567572
const queuedFields: Array<string> = [];
@@ -626,7 +631,10 @@ export function decodeReplyFromBusboy<T>(
626631

627632
export function decodeReply<T>(
628633
body: string | FormData,
629-
options?: {temporaryReferences?: TemporaryReferenceSet},
634+
options?: {
635+
temporaryReferences?: TemporaryReferenceSet,
636+
arraySizeLimit?: number,
637+
},
630638
): Thenable<T> {
631639
if (typeof body === 'string') {
632640
const form = new FormData();
@@ -638,6 +646,7 @@ export function decodeReply<T>(
638646
'',
639647
options ? options.temporaryReferences : undefined,
640648
body,
649+
options ? options.arraySizeLimit : undefined,
641650
);
642651
const root = getRoot<T>(response);
643652
close(response);
@@ -646,7 +655,10 @@ export function decodeReply<T>(
646655

647656
export function decodeReplyFromAsyncIterable<T>(
648657
iterable: AsyncIterable<[string, string | File]>,
649-
options?: {temporaryReferences?: TemporaryReferenceSet},
658+
options?: {
659+
temporaryReferences?: TemporaryReferenceSet,
660+
arraySizeLimit?: number,
661+
},
650662
): Thenable<T> {
651663
const iterator: AsyncIterator<[string, string | File]> =
652664
iterable[ASYNC_ITERATOR]();
@@ -655,6 +667,8 @@ export function decodeReplyFromAsyncIterable<T>(
655667
serverManifest,
656668
'',
657669
options ? options.temporaryReferences : undefined,
670+
undefined,
671+
options ? options.arraySizeLimit : undefined,
658672
);
659673

660674
function progress(

‎packages/react-server-dom-turbopack/src/server/ReactFlightDOMServerBrowser.js‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,10 @@ function prerender(
239239
function decodeReply<T>(
240240
body: string | FormData,
241241
turbopackMap: ServerManifest,
242-
options?: {temporaryReferences?: TemporaryReferenceSet},
242+
options?: {
243+
temporaryReferences?: TemporaryReferenceSet,
244+
arraySizeLimit?: number,
245+
},
243246
): Thenable<T> {
244247
if (typeof body === 'string') {
245248
const form = new FormData();
@@ -251,6 +254,7 @@ function decodeReply<T>(
251254
'',
252255
options ? options.temporaryReferences : undefined,
253256
body,
257+
options ? options.arraySizeLimit : undefined,
254258
);
255259
const root = getRoot<T>(response);
256260
close(response);

0 commit comments

Comments
 (0)