CodeVetter · Repo Unpack · Risk map
facebook/react
The genuinely security-sensitive surface is small but sharp: Flight's Server Actions turn attacker-controlled FormData into a module lookup and function invocation, the taint registry is the only guard against serialising server secrets to the client and it is experimental-only, and the DevTools extension bridges page-world `postMessage` to privileged `chrome.runtime` ports while also running string-`eval` payloads through `chrome.devtools.inspectedWindow.eval`. Operationally the biggest fragility is the fork/shim system — `ReactFiberConfig` and `ReactFeatureFlags` resolve differently under Rollup, Jest and Flow, so a change that passes locally can break a channel nobody ran. `ReactFiberWorkLoop.js` at 5,683 lines with ~60 exported functions and module-level mutable state is the highest blast-radius file in the repo, and the Rust port is a live second implementation of the compiler that must stay snapshot-identical to the TypeScript one.
- `loadServerReference` resolves a client-supplied string id straight into `resolveServerReference(bundlerConfig, id)` → `preloadModule` → `requireModule`; the only validation is `typeof id !== 'string'` (which silently returns `null as any`), so the security boundary rests entirely on the bundler-generated `serverManifest`.
- `decodeAction` distinguishes action fields purely by string prefix (`$ACTION_REF_`, `$ACTION_ID_`, `$ACTION_`) on attacker-controlled FormData keys, and a mismatch falls through to `throw new Error('Cannot handle action key. This is a bug in React.')` — a user-reachable throw framed as an internal invariant.
- The taint protection against leaking secrets to the client is gated off by default outside experimental builds (`export const enableTaint = __EXPERIMENTAL__`), and `taintUniqueValue` early-returns when the flag is false — stable consumers get no taint enforcement.
- `TaintRegistryValues` is a plain `Map<string|bigint, TaintEntry>` with manual refcounting in `cleanup()`, relying on `FinalizationRegistry`; the code explicitly notes that if `FinalizationRegistry` is absent it 'assume[s] that objects live forever' — a correctness cliff on older runtimes.
- The DevTools extension executes code as strings in the inspected page: `evalScripts.js` defines a `.code` variant for each of `checkIfReactPresentInInspectedWindow`, `reload`, `viewElementSource`, `viewAttributeSource` and the selection bridges, intended for `chrome.devtools.inspectedWindow.eval()`.
- The extension's content scripts relay untrusted page-world messages into privileged extension ports: `prepareInjection.js` listens on `window.addEventListener('message', ...)` and `proxy.js` forwards across `chrome.runtime.connect(...)` / `chrome.runtime.onMessage` and back out via `window.postMessage` — a classic content-script trust boundary.
- The DevTools bridge lets the frontend write arbitrary values into a live app — `overrideProps`, `overrideState`, `overrideHookState`, `overrideContext` are first-class bridge events — so anything that can speak the bridge protocol can mutate application state.
- `__REACT_DEVTOOLS_GLOBAL_HOOK__` is installed as a page global and documented in-source as 'a de facto public API', giving any script on the page a handle on every mounted renderer.
- `ReactFiberWorkLoop.js` is 5,683 lines with roughly 60 exports and heavy module-level mutable state (`workInProgressRoot`, `workInProgressSuspendedReason`, `workInProgressRootExitStatus`, `executionContext`), making it the single highest blast-radius file — almost every reconciler behaviour change lands here.
- The fork system is fragile by design: `scripts/rollup/forks.js` substitutes 13 module paths (shared internals, feature flags, fiber config, stream/fizz/flight configs, `EventListener`, `useSyncExternalStore`) and Jest substitutes them differently — so a module can resolve three ways (Rollup, Jest, Flow) and only CI exercises all of them.
- There are 13 `ReactFeatureFlags` forks (`www`, `www-dynamic`, `native-fb`, `native-oss`, `test-renderer`, `eslint-plugin.www`, `readonly`, …); a flag added to the base file without updating every fork is a known failure mode, which is exactly why CI has a dedicated `flags` job and a `/flags` skill.
- `scripts/release/ci-npmrc` writes `//registry.npmjs.org/:_authToken=${NPM_TOKEN}` and three compiler prerelease workflows inject `NPM_TOKEN` from repository secrets — any workflow change that widens trigger conditions on those files widens publish access.
- The MCP server's runtime-perf tool launches a real browser (`puppeteer.launch()`) and runs `page.evaluate` on supplied component code — that is code execution on the developer's machine driven by MCP tool input.
- An Algolia app id and search API key are hard-coded in `compiler/packages/react-mcp-server/src/utils/algolia.ts` (with a source comment pointing at react.dev's public config) — low severity since they are public search-only credentials, but they are real credentials living in the tree.
- The Rust port is a duplicated implementation of a complex pipeline: `compiler/crates/react_compiler/src/entrypoint/pipeline.rs` re-implements the same ~40 passes as `Pipeline.ts`, and `react_compiler/src/lib.rs` re-exports crates 'for backwards compatibility' — divergence between the two is caught only by `yarn snap --rust` in CI.
- The napi bridge converts Rust panics into `napi::Error` strings rather than structured diagnostics, and relies on a hand-tuned 64 MB thread stack to avoid overflow on deep ASTs — both are heuristic mitigations rather than guarantees.
- Legacy code is still resident and flag-guarded rather than removed: `disableLegacyMode`, `LegacyRoot`, `flushSyncWorkOnLegacyRootsOnly`, `isAlreadyFailedLegacyErrorBoundary`, `enableLegacyFBSupport` and `enableLegacyCache` all remain live branches in the work loop and flag file.