[greatscotty]

What this changes

remote-ui counterpart to #738.

The remote environment is untrusted, but createRemoteReceiver() stored text and props without checking their shape, and @remote-ui/react’s RemoteComponent spread remote props straight onto host components. Hosts that run this package on preact/compat are exposed to Preact’s virtual-node detection (constructor === undefined), and the Vue host to Vue’s (__v_isVNode: true). Such objects survive @remote-ui/rpc’s encoder (it rebuilds objects by spreading own keys, so an own constructor: undefined key is preserved), so a remote could render arbitrary markup – including dangerouslySetInnerHTML – on the host via a text node (H1 4072911) or a prop (H1 4133346).

@remote-ui/core

• New validation.ts, exported from the package: normalizeRemoteText, assertSafeRemoteProp/assertSafeRemoteProps, assertRemotePropName, assertRemoteComponentType.
• createRemoteReceiver() applies them in normalizeNode (mount, insert, fragment props), updateText, and updateProps: text is normalized to a string (objects via Object.prototype.toString, never the remote’s toString), props are rejected if any object in them has constructor === undefined or __v_isVNode === true, __proto__ is rejected as a prop name, component types must be strings. Validation runs before anything is retained or attached.

@remote-ui/react

• RemoteComponent never passes children, ref, key, dangerouslySetInnerHTML (or __proto__) from remote props to the host implementation.

Tests

• packages/core/src/tests/validation.test.ts – helper coverage (Preact and Vue shapes, null prototypes, Map/Set/cyclic values, shapes hidden behind a redirected prototype, __proto__ names).
• packages/core/src/tests/receiver.test.ts – receiver-level coverage for mount/insert/update/fragment-prop text and props.
• packages/react/src/tests/untrusted-values.test.tsx – end to end through RemoteRenderer into jsdom.

Before this change the exploit was confirmed end to end with @remote-ui/core + @remote-ui/react on preact/compat: text mount/update, prop mount/update, text inside a fragment prop, and dangerouslySetInnerHTML via spread all injected attacker markup into the host DOM; all are closed after.

Full suite (loom test), loom type-check, and loom lint pass.

cc @robin-drexler

[andrewiggins]

Can we also address the Vue code called out in the PR description?

I think we need to make the following changes to the vue package:

• Raise the vue peer dependency in packages/vue/package.json to >=3.5.9 <4.0.0. Before 3.5.9, Vue treats any object child as a vnode (vuejs/core#12038), so the __v_isVNode check doesn't protect older versions.
• In packages/vue/src/host/RemoteComponent.ts, filter reserved props from remote props before h(Implementation, props), mirroring RESERVED_PROPS in the React host. Cover at least innerHTML, outerHTML, textContent, key, ref, onVnode*, and __proto__. Note to cover onVnode* we'll need a little bit more complex logic than a Set since it's a prefix of props we need to cover.

[andrewiggins]

Let's add innerHTML and outerHTML here for preact/compat, with corresponding tests.