[DevTools] Fix ReDoS vulnerability in Firefox stack trace parser

[everettbu]

Mirror of facebook/react#35509
Original author: yujiteshima

---

Summary

This PR fixes a ReDoS (Regular Expression Denial of Service) vulnerability in the Firefox stack trace parser.

Fixes #35490

The original regex pattern (?:.*".+")?[^@]* in firefoxFrameRegExp contained nested quantifiers that could cause catastrophic backtracking when processing malicious inputs. With a crafted input containing 2000 repeated patterns, the regex took over 2.5 seconds to process, causing the DevTools to become unresponsive.

The fix: Changed .*".+" to "[^"]+" using a negated character class. This achieves O(n) linear time complexity while preserving identical matching behavior for all valid Firefox stack frames.

Input	Before	After
Malicious (2000 repeats)	2500+ ms	0 ms
Valid Firefox stack frames	✅ Works	✅ Works

How did you test this change?

1. Verified the fix resolves the vulnerability:

const firefoxFrameRegExp = /^((?:"[^"]+")?[^@]*)@(.+):(\d+):(\d+)$/;
const nullChar = String.fromCharCode(0);
const maliciousInput = ' ' + ('"' + nullChar).repeat(2000) + '\r!\r!';

const start = Date.now();
firefoxFrameRegExp.test(maliciousInput);
console.log(Date.now() - start + 'ms'); // 0ms (was 2500+ ms)

2. Verified existing functionality is preserved:

// All valid Firefox stack traces still parse correctly
'tt`@https`://react.dev/_next/static/chunks/363.js:1:165558' // ✅
'f`@https`://react.dev/_next/static/chunks/pages/app.js:1:8535' // ✅
'"quoted"`@file`:1:1' // ✅
'funcName`@file`:1:1' // ✅

3. Added a regression test to prevent future ReDoS vulnerabilities in this regex.

4. Ran the standard checks:

yarn linc            # ✅ Lint passed
yarn flow dom-node   # ✅ No errors
yarn prettier        # ✅ Formatted

[greptile-apps]

Greptile Summary

Fixed a critical ReDoS (Regular Expression Denial of Service) vulnerability in the Firefox stack trace parser that could cause DevTools to hang for 2500+ ms when processing malicious input.

• Changed firefoxFrameRegExp from (?:.*".+")? to (?:"[^"]+")? to eliminate catastrophic backtracking
• The fix uses a negated character class instead of nested quantifiers, achieving O(n) linear time complexity
• All existing Firefox stack frame parsing functionality is preserved
• Added comprehensive regression test to prevent future ReDoS vulnerabilities

Confidence Score: 5/5

• This PR is safe to merge with no risk
• The regex change is a textbook fix for ReDoS vulnerabilities - replacing nested quantifiers with a negated character class is the standard solution. The fix is minimal, focused, and mathematically sound (O(n) vs exponential). Comprehensive test coverage validates both the security fix and preservation of existing functionality.
• No files require special attention

Important Files Changed

Filename	Overview
packages/react-devtools-shared/src/backend/utils/parseStackTrace.js	Fixed ReDoS vulnerability in Firefox stack trace regex by replacing nested quantifiers with negated character class, achieving O(n) complexity while maintaining identical matching behavior
packages/react-devtools-shared/src/tests/utils-test.js	Added regression test that validates the fix prevents catastrophic backtracking on malicious input (completes in <100ms instead of 2500+ms)

[github-actions]

This pull request has been automatically marked as stale. If this pull request is still relevant, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize reviewing it yet. Your contribution is very much appreciated.

[github-actions]

Closing this pull request after a prolonged period of inactivity. If this issue is still present in the latest release, please ask for this pull request to be reopened. Thank you!