Fix ReDoS vulnerability in Firefox stack trace parser (#35490)

[everettbu]

Mirror of facebook/react#35609
Original author: aarushdubey

---

Summary

Fixes #35490 - Inefficient Regular Expression Complexity in React DevTools

Changes

• Replaced vulnerable regex pattern in Firefox stack trace parser with secure alternative
• • Changed (?:.*".+")?[^@]* to (?:"[^"]+")?[^@]*
• • Uses negated character class instead of nested quantifiers to prevent catastrophic backtracking
• • Added regression test to prevent future ReDoS vulnerabilities

Performance Impact

• Before: Malicious input causes 2500+ ms freeze
• • After: Same input completes in < 1ms
• • Maintains identical matching behavior for valid stack traces

Testing

• All existing tests pass (133/133)
• • Added regression test with proof-of-concept malicious input
• • Test ensures parsing completes in < 100ms

Reference

• Based on analysis from Issue #35490 - Similar pattern to PR #35509

[greptile-apps]

Greptile Summary

Fixed a critical ReDoS (Regular Expression Denial of Service) vulnerability in the Firefox stack trace parser that could cause the browser to freeze for 2500+ ms when processing malicious input.

• Changed firefoxFrameRegExp from (?:.*".+")? to (?:"[^"]+")? on line 62 of parseStackTrace.js:62
• Replaced nested quantifiers with negated character class to eliminate catastrophic backtracking
• Added regression test with proof-of-concept malicious input to ensure parsing completes in < 100ms
• Performance impact: malicious input now completes in < 1ms vs 2500+ ms before
• All existing tests pass (133/133), matching behavior preserved for valid stack traces

Confidence Score: 5/5

• This PR is safe to merge - it fixes a critical security vulnerability with a minimal, well-tested change
• The regex fix is correct and secure: replacing .* with [^"]+ eliminates exponential backtracking while preserving matching behavior. The regression test validates the fix with the exact malicious input pattern. No logic changes beyond the regex pattern itself.
• No files require special attention

Important Files Changed

Filename	Overview
packages/react-devtools-shared/src/backend/utils/parseStackTrace.js	Fixed ReDoS vulnerability in Firefox stack parser by replacing vulnerable regex with secure alternative
packages/react-devtools-shared/src/tests/utils-test.js	Added regression test to verify malicious input completes in < 100ms

[github-actions]

This pull request has been automatically marked as stale. If this pull request is still relevant, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize reviewing it yet. Your contribution is very much appreciated.

[github-actions]

Closing this pull request after a prolonged period of inactivity. If this issue is still present in the latest release, please ask for this pull request to be reopened. Thank you!