fix(dev-server): validate open-stack-frame request body; test: reduce E2E CI load

- Reject open-stack-frame bodies where file is not a string, contains
  NUL bytes, or lineNumber is not numeric, and declare the plugin's
  @fastify/sensible dependency.
- Run the E2E dev servers with --platform ios: the suite exercises a
  single platform and compiling both doubled the load on shared CI
  runners, pushing an unrelated tester-app bundle test past its
  timeout.
- Stop test servers with SIGKILL — a SIGTERM caught mid-compilation
  left an orphan holding the port for later runs.

Author: dannyhw

packages/dev-server/src/plugins/devtools/devtoolsPlugin.ts

@@ -46,6 +46,14 @@ async function devtoolsPlugin(
       const { file, lineNumber } = parseRequestBody<OpenStackFrameRequestBody>(
         request.body
       );
+      if (
+        typeof file !== 'string' ||
+        file.includes('\0') ||
+        !Number.isFinite(Number(lineNumber))
+      ) {
+        reply.badRequest('Invalid open-stack-frame request body');
+        return;
+      }
       const filepath = delegate.devTools?.resolveProjectPath(file) ?? file;
 
       // launch-editor silently ignores files that don't exist, so surface
@@ -88,5 +96,5 @@ async function devtoolsPlugin(
 
 export default fastifyPlugin(devtoolsPlugin, {
   name: 'devtools-plugin',
-  dependencies: ['wss-plugin'],
+  dependencies: ['@fastify/sensible', 'wss-plugin'],
 });

tests/integration/e2e/symbolication.test.ts

@@ -54,7 +54,17 @@ let remoteFrame: StackFrame;
 function startServer(configFile: string, port: number): ChildProcess {
   const child = spawn(
     reactNativeBin,
-    ['webpack-start', '--config', configFile, '--port', String(port)],
+    [
+      'webpack-start',
+      '--config',
+      configFile,
+      '--port',
+      String(port),
+      // Compile a single platform: the suite only exercises one, and the
+      // extra compilation is wasted load on shared CI runners.
+      '--platform',
+      PLATFORM,
+    ],
     {
       cwd: appDir,
       env: {
@@ -74,7 +84,10 @@ function startServer(configFile: string, port: number): ChildProcess {
 function stopServer(child: ChildProcess | undefined) {
   if (child?.pid) {
     try {
-      process.kill(-child.pid, 'SIGTERM');
+      // SIGKILL the whole process group: these are throwaway test servers,
+      // and a SIGTERM caught mid-compilation has been observed to leave an
+      // orphan behind that breaks subsequent runs.
+      process.kill(-child.pid, 'SIGKILL');
     } catch {
       // Already gone.
     }