Fix autoFocus for anchor elements and ReDoS in devtools stack parsing#35692
Fix autoFocus for anchor elements and ReDoS in devtools stack parsing#35692d1maash wants to merge 2 commits intofacebook:mainfrom
Conversation
autoFocus is a global HTML attribute but React only handled it for button, input, select, and textarea. This adds anchor tags to the autoFocus handling in finalizeInitialChildren and commitMount, so that <a autoFocus /> correctly receives focus after mount.
…#35490) Fix two regex patterns in parseStackTrace.js vulnerable to catastrophic backtracking: 1. firefoxFrameRegExp: replace overlapping .*".+" with non-overlapping character classes [^@"]*(?:"[^"]*"[^@"]*)* 2. CHROME_STACK_REGEXP: simplify detection regex from /^\s*at .*(\S+:\d+|\(native\))/m to /^\s*at /m to eliminate the O(n^2) backtracking between .* and \S+
|
Hi @d1maash! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
1 participant
Summary
This PR addresses two open issues:
autoFocusis a [global HTMLattribute](https://developer.mozilla.org/en-US/docs/W
eb/HTML/Global_attributes/autofocus) supported by all
major browsers, but React only handles it for
button,input,select, andtextarea. Added<a>to the autoFocus handling infinalizeInitialChildrenandcommitMountso that<a href="..." autoFocus />correctly receives focusafter mount.
parsing (Bug: Inefficient Regular Expression Complexity in react #35490)
Two regex patterns in
parseStackTrace.jsarevulnerable to catastrophic backtracking:
firefoxFrameRegExp:(?:.*".+")?[^@]*contains overlapping quantifiers that cause
exponential backtracking on inputs with quotes but no
@. Replaced with[^@"]*(?:"[^"]*"[^@"]*)*usingnon-overlapping character classes.
CHROME_STACK_REGEXP:.*(\S+:\d+|\(native\))causes O(n²) backtracking because
.*and\S+overlap. Simplified to
/^\s*at /mwhich issufficient for Chrome vs Firefox format detection.