Repository: facebook/react
File: packages/react-client/src/ReactFlightClient.js (JavaScript)

Code before:
        if (__DEV__) {
          // In DEV mode we allow debug objects to specify themselves as instances of
          // another constructor.
          const ref = value.slice(2);
          return getOutlinedModel(
            response,
            ref,
            parentObject,
            key,
            applyConstructor,
          );
        }
        //Fallthrough
      }
      case 'E': {
        if (__DEV__) {
          // In DEV mode we allow indirect eval to produce functions for logging.
          // This should not compile to eval() because then it has local scope access.
          const code = value.slice(2);
          try {
            // eslint-disable-next-line no-eval
            return (0, eval)(code);
          } catch (x) {
            // We currently use this to express functions so we fail parsing it,
            // let's just return a blank function as a place holder.
            let fn;
            try {
              fn = getInferredFunctionApproximate(code);
              if (code.startsWith('Object.defineProperty(')) {
                const DESCRIPTOR = ',"name",{value:"';
                const idx = code.lastIndexOf(DESCRIPTOR);
                if (idx !== -1) {
                  const name = JSON.parse(
                    code.slice(idx + DESCRIPTOR.length - 1, code.length - 2),
                  );
                  // $FlowFixMe[cannot-write]
                  Object.defineProperty(fn, 'name', {value: name});
                }
              }
            } catch (_) {
              fn = function () {};
            }
            return fn;
          }
        }
        // Fallthrough
      }
      case 'Y': {
        if (__DEV__) {
          if (value.length > 2) {
            const debugChannel = response._debugChannel;

Review comment (bug):
We should really take this fallback path whenever there’s a static initializer or static constructor function since that causes a side effect that might be unexpected even if it doesn’t error.

It could also be a security issue if you’re debugging a third party RSC service (which isn’t really supported yet but should minimize the surface).

It’s just tricky. Might have to bail on anything that contains lower case class and static at word boundaries.

Code after:
      }
      case 'P': {
        if (__DEV__) {
          // In DEV mode we allow debug objects to specify themselves as instances of
          // another constructor.
          const ref = value.slice(2);
          return getOutlinedModel(
            response,
            ref,
            parentObject,
            key,
            applyConstructor,
          );
        }
        //Fallthrough
      }
      case 'E': {
        if (__DEV__) {
          // In DEV mode we allow indirect eval to produce functions for logging.
          // This should not compile to eval() because then it has local scope access.
          const code = value.slice(2);
          try {
            // If this might be a class constructor with a static initializer or
            // static constructor then don't eval it. It might cause unexpected
            // side-effects. Instead, fallback to parsing out the function type
            // and name.
            if (!mightHaveStaticConstructor.test(code)) {
              // eslint-disable-next-line no-eval
              return (0, eval)(code);
            }
          } catch (x) {
            // Fallthrough to fallback case.
          }
          // We currently use this to express functions so we fail parsing it,
          // let's just return a blank function as a place holder.
          let fn;
          try {
            fn = getInferredFunctionApproximate(code);
            if (code.startsWith('Object.defineProperty(')) {
              const DESCRIPTOR = ',"name",{value:"';
              const idx = code.lastIndexOf(DESCRIPTOR);
              if (idx !== -1) {
                const name = JSON.parse(
                  code.slice(idx + DESCRIPTOR.length - 1, code.length - 2),
                );
                // $FlowFixMe[cannot-write]
                Object.defineProperty(fn, 'name', {value: name});
              }
            }
          } catch (_) {
            fn = function () {};