Skip to content

Harden Fizz resource caches against prototype keys - #37432

Open
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:fix/react-fizz-resource-map-keys
Open

Harden Fizz resource caches against prototype keys#37432
OskarEichler wants to merge 1 commit into
react:mainfrom
OskarEichler:fix/react-fizz-resource-map-keys

Conversation

@OskarEichler

Copy link
Copy Markdown

Summary

  • Store request-local Fizz resource indexes in null-prototype dictionaries.
  • Use React's shared safe ownership helper for every resource lookup.
  • Cover DNS, connect, image, style, script, module, and unknown resource caches.
  • Add a regression for hasOwnProperty and __proto__ URLs, including deduplication.

Breaking changes

None. Arbitrary resource strings that previously crashed or bypassed deduplication now behave as ordinary keys.

Verification

  • Full ReactDOMFizzServer suite: 184 tests passed, including 2 snapshots.
  • ReactDOMFloat suite: 142 tests passed, 1 skipped.
  • Changed-source linc, Prettier, and git diff --check passed.

Fixes #37431

@meta-cla meta-cla Bot added the CLA Signed label Aug 30, 2026
@github-actions

Copy link
Copy Markdown

A size report will appear here when the build finishes.

Generated by sizebot against 97cd2b6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

1 participant