Security: Add input validation limits to React Server Components

[Copilot]

Addresses 5 publicly disclosed vulnerabilities in React Server Components: GHSA-fv66-9v8q-g76r (RCE), GHSA-925w-6v3x-g4j4 (source exposure), GHSA-2m3v-v2m8-q956, GHSA-7gmr-mq3h-m5h9, GHSA-83fc-fqcc-2hmg (DoS variants).

Changes

Input validation limits added to ReactFlightReplyServer.js:

• JSON payload: 50MB max before parsing (prevents memory exhaustion)
• String length: 10MB per string, 500MB cumulative (prevents memory exhaustion)
• FormData keys: 100,000 max (prevents iteration-based DoS)

Path traversal protection in ReactFlightActionServer.js:

• Server reference IDs validated to block .., \0, and leading /

Example:

// Before JSON.parse(), validate payload size
if (resolvedModel.length > MAX_JSON_PAYLOAD_SIZE) {
  throw new Error('JSON payload too large...');
}
const rawModel = JSON.parse(resolvedModel);

Testing

New test suite ReactFlightDOMSecurity-test.js verifies limits enforce correctly while allowing legitimate large payloads (1000+ form fields, 100KB documents, arrays of 1000+ items).

All existing React Flight tests pass without modification - limits are high enough to not affect normal usage patterns.

Documentation

SECURITY_MITIGATIONS.md details rationale for each limit value and impact analysis.