Support null-prototype objects in Flight#36818
Conversation
## Motivation Flight currently rejects objects with a null prototype. That prevents passing map-like records that are intentionally protected from prototype pollution, even though their enumerable string keys are otherwise serializable data. This is useful for data stores such as graphql-js response stores where keys are not necessarily controlled. The change serializes null-prototype objects with a dedicated Flight marker and revives them with Object.create(null), while preserving keys such as __proto__ as own data properties. The downstream GraphQL incremental delivery example now has the problem and fix split across two PRs. yaacovCR/graphql-incremental-delivery-client-examples#1 captured the failing RSC boundary after passing the raw GraphQL.js execution result through a Client Component prop. yaacovCR/graphql-incremental-delivery-client-examples#2 applies this React change as a local react-server-dom-webpack patch and flips that boundary test to prove the raw null-prototype product.summary object serializes successfully. ## How did you test this change? - yarn prettier - yarn linc - yarn flow dom-node-webpack - yarn test ReactFlight-test ReactFlightDOMReply-test - yarn test --prod ReactFlight-test ReactFlightDOMReply-test --testNamePattern="null-prototype" I also ran yarn test --prod ReactFlight-test ReactFlightDOMReply-test. The new null-prototype tests passed, but the full production run still failed in existing ReactFlight production error stack expectations unrelated to this change. Beyond the React unit tests, yaacovCR/graphql-incremental-delivery-client-examples#2 demonstrates the fix in a real react-server-dom-webpack Server-to-Client serialization path: its fixture calls renderToReadableStream with GraphQL.js's raw null-prototype summary object, asserts that React reports no serialization errors, and checks that the emitted Flight payload includes the null-prototype marker. That example PR was verified with npm run verify.
|
Hi @yaacovCR! Thank you for your pull request. We require contributors to sign our Contributor License Agreement, and yours needs attention. You currently have a record in our system, but the CLA is no longer valid, and will need to be resubmitted. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at [email protected]. Thanks! |
There was a problem hiding this comment.
This PR introduces support for null-prototype objects in React Flight by adding serialization and deserialization methods, as well as enhancing tests to ensure this functionality works correctly. The changes are well-contained and align with the goal of improving compatibility with different object types.
|
Just a gentle ping. |
2 participants
Summary
Flight currently rejects objects with a null prototype. That prevents passing map-like records that are intentionally protected from prototype pollution, even though their enumerable string keys are otherwise serializable data.
This is useful for data stores such as graphql-js response stores where keys are not necessarily controlled. The change serializes null-prototype objects with a dedicated Flight marker and revives them with Object.create(null), while preserving keys such as proto as own data properties.
How did you test this change?
Beyond the React unit tests, yaacovCR/graphql-incremental-delivery-client-examples#2 demonstrates the fix in a real react-server-dom-webpack Server-to-Client serialization path: its fixture calls renderToReadableStream with GraphQL.js's raw null-prototype summary object, asserts that React reports no serialization errors, and checks that the emitted Flight payload includes the null-prototype marker.