Replace REACT_ELEMENT_TYPE magicnum with Infinity.

This closes the XSS hole on older browsers that don't support Symbol. More discussion: facebook#4832 (comment)
STRML · Jan 12, 2016 · e7e48fd · e7e48fd
1 parent b60e8c2
commit e7e48fd
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/src/isomorphic/classic/element/ReactElement.js b/src/isomorphic/classic/element/ReactElement.js
@@ -20,7 +20,7 @@ var canDefineProperty = require('canDefineProperty');
 // nor polyfill, then a plain number is used for performance.
 var REACT_ELEMENT_TYPE =
   (typeof Symbol === 'function' && Symbol.for && Symbol.for('react.element')) ||
-  0xeac7;
+  Infinity;
 
 var RESERVED_PROPS = {
   key: true,

diff --git a/src/isomorphic/classic/element/__tests__/ReactElement-test.js b/src/isomorphic/classic/element/__tests__/ReactElement-test.js
@@ -45,7 +45,7 @@ describe('ReactElement', function() {
   });
 
   it('uses the fallback value when in an environment without Symbol', function() {
-    expect(<div />.$$typeof).toBe(0xeac7);
+    expect(<div />.$$typeof).toBe(Infinity);
   });
 
   it('returns a complete element according to spec', function() {
@@ -207,7 +207,9 @@ describe('ReactElement', function() {
     expect(React.isValidElement({ type: 'div', props: {} })).toEqual(false);
 
     var jsonElement = JSON.stringify(React.createElement('div'));
-    expect(React.isValidElement(JSON.parse(jsonElement))).toBe(true);
+    // Should be false, even with Symbol not present, due to Infinity value
+    // which cannot be serialized into/from JSON.
+    expect(React.isValidElement(JSON.parse(jsonElement))).toBe(false);
   });
 
   it('allows the use of PropTypes validators in statics', function() {