[CodeQL] Patch fmt/core.h, folly/ConstexprMath.h, and loadBundleFromServer.js

.cspell.json

@@ -19,6 +19,7 @@
         "packages/@react-native-windows/tester",
         "packages/react-native-platform-override/src/e2etest/collateral",
         "vnext/Folly/TEMP_UntilFollyUpdate",
+        "vnext/fmt/TEMP_UntilFmtUpdate",
         "vnext/ReactCommon/TEMP_UntilReactCommonUpdate"
     ],
     "useGitignore": true,

change/@office-iss-react-native-win32-c19d617e-ea40-47f8-8b84-e955cb6aa24c.json

@@ -0,0 +1,7 @@
+{
+  "type": "none",
+  "comment": "CodeQL patch",
+  "packageName": "@office-iss/react-native-win32",
+  "email": "1422161+marlenecota@users.noreply.github.com",
+  "dependentChangeType": "none"
+}

change/react-native-windows-c0a19313-151e-4923-99a9-6de723d37dbe.json

@@ -0,0 +1,7 @@
+{
+  "type": "prerelease",
+  "comment": "Folly and Fmt CodeQL patches",
+  "packageName": "react-native-windows",
+  "email": "1422161+marlenecota@users.noreply.github.com",
+  "dependentChangeType": "patch"
+}

packages/@office-iss/react-native-win32/overrides.json

@@ -217,6 +217,13 @@
       "type": "platform",
       "file": "src-win/Libraries/Components/View/ViewWin32.js"
     },
+    {
+      "type": "patch",
+      "file": "src-win/Libraries/Core/Devtools/loadBundleFromServer.win32.js",
+      "baseFile": "packages/react-native/Libraries/Core/Devtools/loadBundleFromServer.js",
+      "baseHash": "14662281c97222b45893308b744a7dc7c2000801",
+      "issue": 12704
+    },
     {
       "type": "patch",
       "file": "src-win/Libraries/Core/ReactNativeVersionCheck.win32.js",

packages/@office-iss/react-native-win32/src-win/Libraries/Core/Devtools/loadBundleFromServer.win32.js

@@ -0,0 +1,153 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @flow strict-local
+ * @format
+ * @oncall react_native
+ */
+
+import Networking from '../../Network/RCTNetworking';
+import DevLoadingView from '../../Utilities/DevLoadingView';
+import HMRClient from '../../Utilities/HMRClient';
+import getDevServer from './getDevServer';
+
+declare var global: {globalEvalWithSourceUrl?: (string, string) => mixed, ...};
+
+let pendingRequests = 0;
+
+const cachedPromisesByUrl = new Map<string, Promise<void>>();
+
+function asyncRequest(
+  url: string,
+): Promise<{body: string, headers: {[string]: string}}> {
+  let id = null;
+  let responseText = null;
+  let headers = null;
+  let dataListener;
+  let completeListener;
+  let responseListener;
+  let incrementalDataListener;
+  return new Promise<{body: string, headers: {[string]: string}}>(
+    (resolve, reject) => {
+      dataListener = Networking.addListener(
+        'didReceiveNetworkData',
+        ([requestId, response]) => {
+          if (requestId === id) {
+            responseText = response;
+          }
+        },
+      );
+      incrementalDataListener = Networking.addListener(
+        'didReceiveNetworkIncrementalData',
+        ([requestId, data]) => {
+          if (requestId === id) {
+            if (responseText != null) {
+              responseText += data;
+            } else {
+              responseText = data;
+            }
+          }
+        },
+      );
+      responseListener = Networking.addListener(
+        'didReceiveNetworkResponse',
+        ([requestId, status, responseHeaders]) => {
+          if (requestId === id) {
+            headers = responseHeaders;
+          }
+        },
+      );
+      completeListener = Networking.addListener(
+        'didCompleteNetworkResponse',
+        ([requestId, error]) => {
+          if (requestId === id) {
+            if (error) {
+              reject(error);
+            } else {
+              //$FlowFixMe[incompatible-call]
+              resolve({body: responseText, headers});
+            }
+          }
+        },
+      );
+      Networking.sendRequest(
+        'GET',
+        'asyncRequest',
+        url,
+        {},
+        '',
+        'text',
+        true,
+        0,
+        requestId => {
+          id = requestId;
+        },
+        true,
+      );
+    },
+  ).finally(() => {
+    dataListener?.remove();
+    completeListener?.remove();
+    responseListener?.remove();
+    incrementalDataListener?.remove();
+  });
+}
+
+function buildUrlForBundle(bundlePathAndQuery: string) {
+  const {url: serverUrl} = getDevServer();
+  return (
+    serverUrl.replace(/\/+$/, '') + '/' + bundlePathAndQuery.replace(/^\/+/, '')
+  );
+}
+
+module.exports = function (bundlePathAndQuery: string): Promise<void> {
+  const requestUrl = buildUrlForBundle(bundlePathAndQuery);
+  let loadPromise = cachedPromisesByUrl.get(requestUrl);
+
+  if (loadPromise) {
+    return loadPromise;
+  }
+  DevLoadingView.showMessage('Downloading...', 'load');
+  ++pendingRequests;
+
+  loadPromise = asyncRequest(requestUrl)
+    .then<void>(({body, headers}) => {
+      if (
+        headers['Content-Type'] != null &&
+        headers['Content-Type'].indexOf('application/json') >= 0
+      ) {
+        // Errors are returned as JSON.
+        throw new Error(
+          JSON.parse(body).message ||
+            `Unknown error fetching '${bundlePathAndQuery}'`,
+        );
+      }
+
+      HMRClient.registerBundle(requestUrl);
+
+      // Some engines do not support `sourceURL` as a comment. We expose a
+      // `globalEvalWithSourceUrl` function to handle updates in that case.
+      if (global.globalEvalWithSourceUrl) {
+        global.globalEvalWithSourceUrl(body, requestUrl);
+      } else {
+        // [Windows #12704 - CodeQL patch]
+        // eslint-disable-next-line no-eval
+        eval(body); // CodeQL [js/eval-usage] Debug only. Developer inner loop.
+      }
+    })
+    .catch<void>(e => {
+      cachedPromisesByUrl.delete(requestUrl);
+      throw e;
+    })
+    .finally(() => {
+      if (!--pendingRequests) {
+        DevLoadingView.hide();
+      }
+    });
+
+  cachedPromisesByUrl.set(requestUrl, loadPromise);
+  return loadPromise;
+};

vnext/Folly/TEMP_UntilFollyUpdate/ConstexprMath.h

@@ -257,7 +257,8 @@ constexpr auto& constexpr_iterated_squares_desc_2_v =
 template <typename T, typename... Ts>
 constexpr T constexpr_max(T a, Ts... ts) {
   T list[] = {ts..., a}; // 0-length arrays are illegal
-  for (auto i = 0u; i < sizeof...(Ts); ++i) {
+  // [Windows #12703 - Fix folly CodeQL issues]
+  for (size_t i = 0; i < sizeof...(Ts); ++i) {
     a = list[i] < a ? a : list[i];
   }
   return a;
@@ -268,7 +269,8 @@ constexpr T constexpr_max(T a, Ts... ts) {
 template <typename T, typename... Ts>
 constexpr T constexpr_min(T a, Ts... ts) {
   T list[] = {ts..., a}; // 0-length arrays are illegal
-  for (auto i = 0u; i < sizeof...(Ts); ++i) {
+  // [Windows #12703 - Fix folly CodeQL issues]
+  for (size_t i = 0; i < sizeof...(Ts); ++i) {
     a = list[i] < a ? list[i] : a;
   }
   return a;