[Flight] Never parse "then" functions (#35289)
AFAIK this is not needed to prevent any exploit but we don't really need this. We allow functions on pretty much any other object anyway but never on the "then" property since those would be serialized as Promises by the client anyway.
Sebastian Markbåge committed
Dec 4, 2025 at 19:05 UTC
3016ff87d87aeff5181d95348d609039fdcad94a
1 file changed
+16
-1
packages/react-server/src/ReactFlightReplyServer.js
+16
-1
@@ -437,6 +437,11 @@ function loadServerReference<A: Iterable<any>, T>(
437
if (typeof id !== 'string') {
438
return (null: any);
439
}
440
+ if (key === 'then') {
441
+ // This should never happen because we always serialize objects with then-functions
442
+ // as "thenable" which reduces to ReactPromise with no other fields.
443
+ return (null: any);
444
+ }
445
const serverReference: ServerReference<T> =
446
resolveServerReference<$FlowFixMe>(response._bundlerConfig, id);
447
// We expect most servers to not really need this because you'd just have all
@@ -976,7 +981,17 @@ function extractIterator(response: Response, model: Array<any>): Iterator<any> {
981
return model[Symbol.iterator]();
982
}
983
979
-function createModel(response: Response, model: any): any {
984
+function createModel(
985
+ response: Response,
986
+ model: any,
987
+ parentObject: Object,
988
+ key: string,
989
+): any {
990
+ if (key === 'then' && typeof model === 'function') {
991
+ // This should never happen because we always serialize objects with then-functions
992
+ // as "thenable" which reduces to ReactPromise with no other fields.
993
+ return null;
994
+ }
995
return model;
996
}
997