mirror of
https://github.com/facebook/react.git
synced 2025-11-01 09:12:30 +00:00
Sebastian Markbåge
72e02a8350
As mentioned in #28609 there's a potential security risk if you allow a passed value to the server to spoof Elements because it allows a hacker to POST cross origin. This is only an issue if your framework allows this which it shouldn't but it seems like we should provide an extra layer of security here. ```js function action(errors, payload) { try { ... } catch (x) { return [newError].concat(errors); } } ``` ```js const [errors, formAction] = useActionState(action); return <div>{errors}</div>; ``` This would allow you to construct a payload where the previous "errors" set includes something like `<script src="danger.js" />`. We could block only elements from being received but it could potentially be a risk with creating other React types like Context too. We use symbols as a way to securely brand these. Most JS don't use this kind of branding with symbols like we do. They're generally properties which we don't support anyway. However in theory someone else could be using them like we do. So in an abundance of carefulness I just ban all symbols from being passed (except by temporary reference) - not just ours. This means that the format isn't fully symmetric even beyond just React Nodes. #28611 allows code that includes symbols/elements to continue working but may have to bail out to replaying instead of no JS sometimes. However, you still can't access the symbols inside the server - they're by reference only.
42 lines
1.1 KiB
JavaScript
42 lines
1.1 KiB
JavaScript
/**
|
|
* Copyright (c) Meta Platforms, Inc. and affiliates.
|
|
*
|
|
* This source code is licensed under the MIT license found in the
|
|
* LICENSE file in the root directory of this source tree.
|
|
*
|
|
* @flow
|
|
*/
|
|
|
|
interface Reference {}
|
|
|
|
export opaque type TemporaryReferenceSet = Array<Reference | symbol>;
|
|
|
|
export function createTemporaryReferenceSet(): TemporaryReferenceSet {
|
|
return [];
|
|
}
|
|
|
|
export function writeTemporaryReference(
|
|
set: TemporaryReferenceSet,
|
|
object: Reference | symbol,
|
|
): number {
|
|
// We always create a new entry regardless if we've already written the same
|
|
// object. This ensures that we always generate a deterministic encoding of
|
|
// each slot in the reply for cacheability.
|
|
const newId = set.length;
|
|
set.push(object);
|
|
return newId;
|
|
}
|
|
|
|
export function readTemporaryReference<T>(
|
|
set: TemporaryReferenceSet,
|
|
id: number,
|
|
): T {
|
|
if (id < 0 || id >= set.length) {
|
|
throw new Error(
|
|
"The RSC response contained a reference that doesn't exist in the temporary reference set. " +
|
|
'Always pass the matching set that was used to create the reply when parsing its response.',
|
|
);
|
|
}
|
|
return (set[id]: any);
|
|
}
|