GeezerVison is showing github.com — lib: use `__proto__: null` when calling `ObjectDefineProperty` · nodejs/node@34a537c
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: lib/internal/debugger/inspect_repl.js +12-8Lines changed: 12 additions & 8 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -19,15 +19,17 @@ const { | 19 | 19 | JSONStringify, | 20 | 20 | MathMax, | 21 | 21 | ObjectAssign, | | 22 | + ObjectDefineProperties, | 22 | 23 | ObjectDefineProperty, | | 24 | + ObjectGetOwnPropertyDescriptors, | 23 | 25 | ObjectKeys, | | 26 | + ObjectSetPrototypeOf, | 24 | 27 | ObjectValues, | 25 | 28 | Promise, | 26 | 29 | PromisePrototypeThen, | 27 | 30 | PromiseResolve, | 28 | 31 | PromiseWithResolvers, | 29 | 32 | ReflectGetOwnPropertyDescriptor, | 30 | | - ReflectOwnKeys, | 31 | 33 | RegExpPrototypeExec, | 32 | 34 | SafeMap, | 33 | 35 | SafePromiseAllReturnArrayLike, | @@ -347,18 +349,20 @@ class ScopeSnapshot { | 347 | 349 | } | 348 | 350 |
| 349 | 351 | function copyOwnProperties(target, source) { | 350 | | - ArrayPrototypeForEach( | 351 | | - ReflectOwnKeys(source), | 352 | | - (prop) => { | 353 | | - const desc = ReflectGetOwnPropertyDescriptor(source, prop); | 354 | | - ObjectDefineProperty(target, prop, desc); | 355 | | - }); | | 352 | + const descriptors = ObjectGetOwnPropertyDescriptors(source); | | 353 | + | | 354 | + const descValues = ObjectValues(descriptors); | | 355 | + for (let i = 0; i < descValues.length; ++i) { | | 356 | + ObjectSetPrototypeOf(descValues[i], null); | | 357 | + } | | 358 | + | | 359 | + ObjectDefineProperties(target, descriptors); | 356 | 360 | } | 357 | 361 |
| 358 | 362 | function aliasProperties(target, mapping) { | 359 | 363 | ArrayPrototypeForEach(ObjectKeys(mapping), (key) => { | 360 | 364 | const desc = ReflectGetOwnPropertyDescriptor(target, key); | 361 | | - ObjectDefineProperty(target, mapping[key], desc); | | 365 | + ObjectDefineProperty(target, mapping[key], { __proto__: null, ...desc }); | 362 | 366 | }); | 363 | 367 | } | 364 | 368 |
| |
Collapse file Copy file name to clipboardExpand all lines: lib/internal/http2/core.js +1Lines changed: 1 addition & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -3246,6 +3246,7 @@ function handleHeaderContinue(headers) { | 3246 | 3246 | } | 3247 | 3247 |
| 3248 | 3248 | const setTimeoutValue = { | | 3249 | + __proto__: null, | 3249 | 3250 | configurable: true, | 3250 | 3251 | enumerable: true, | 3251 | 3252 | writable: true, | |
Collapse file Copy file name to clipboardExpand all lines: lib/internal/per_context/domexception.js +1-1Lines changed: 1 addition & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -199,7 +199,7 @@ for (const { 0: name, 1: codeName, 2: value } of [ | 199 | 199 | // There are some more error names, but since they don't have codes assigned, | 200 | 200 | // we don't need to care about them. | 201 | 201 | ]) { | 202 | | - const desc = { enumerable: true, value }; | | 202 | + const desc = { __proto__: null, enumerable: true, value }; | 203 | 203 | ObjectDefineProperty(DOMException, codeName, desc); | 204 | 204 | ObjectDefineProperty(DOMExceptionPrototype, codeName, desc); | 205 | 205 | nameToCodeMap.set(name, value); | |
Collapse file Copy file name to clipboardExpand all lines: lib/internal/test_runner/mock/mock.js +11-6Lines changed: 11 additions & 6 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -7,10 +7,14 @@ const { | 7 | 7 | FunctionPrototypeBind, | 8 | 8 | FunctionPrototypeCall, | 9 | 9 | ObjectAssign, | | 10 | + ObjectDefineProperties, | 10 | 11 | ObjectDefineProperty, | 11 | 12 | ObjectGetOwnPropertyDescriptor, | | 13 | + ObjectGetOwnPropertyDescriptors, | 12 | 14 | ObjectGetPrototypeOf, | 13 | 15 | ObjectKeys, | | 16 | + ObjectSetPrototypeOf, | | 17 | + ObjectValues, | 14 | 18 | Proxy, | 15 | 19 | ReflectApply, | 16 | 20 | ReflectConstruct, | @@ -146,7 +150,7 @@ class MockFunctionContext { | 146 | 150 |
| 147 | 151 | if (typeof methodName === 'string') { | 148 | 152 | // This is an object method spy. | 149 | | - ObjectDefineProperty(object, methodName, descriptor); | | 153 | + ObjectDefineProperty(object, methodName, { __proto__: null, ...descriptor }); | 150 | 154 | } else { | 151 | 155 | // This is a bare function spy. There isn't much to do here but make | 152 | 156 | // the mock call the original function. | @@ -880,13 +884,14 @@ function normalizeModuleMockOptions(options) { | 880 | 884 |
| 881 | 885 |
| 882 | 886 | function copyOwnProperties(from, to) { | 883 | | - const keys = ObjectKeys(from); | | 887 | + const descriptors = ObjectGetOwnPropertyDescriptors(from); | 884 | 888 |
| 885 | | - for (let i = 0; i < keys.length; ++i) { | 886 | | - const key = keys[i]; | 887 | | - const descriptor = ObjectGetOwnPropertyDescriptor(from, key); | 888 | | - ObjectDefineProperty(to, key, descriptor); | | 889 | + const descValues = ObjectValues(descriptors); | | 890 | + for (let i = 0; i < descValues.length; ++i) { | | 891 | + ObjectSetPrototypeOf(descValues[i], null); | 889 | 892 | } | | 893 | + | | 894 | + ObjectDefineProperties(to, descriptors); | 890 | 895 | } | 891 | 896 |
| 892 | 897 | function setupSharedModuleState() { | |
Collapse file Copy file name to clipboardExpand all lines: lib/internal/test_runner/mock/mock_timers.js +3-2Lines changed: 3 additions & 2 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -12,6 +12,7 @@ const { | 12 | 12 | ObjectDefineProperty, | 13 | 13 | ObjectGetOwnPropertyDescriptor, | 14 | 14 | ObjectGetOwnPropertyDescriptors, | | 15 | + ObjectSetPrototypeOf, | 15 | 16 | PromiseWithResolvers, | 16 | 17 | ReflectApply, | 17 | 18 | Symbol, | @@ -325,7 +326,7 @@ class MockTimers { | 325 | 326 | } | 326 | 327 |
| 327 | 328 | #restoreOriginalAbortSignalTimeout() { | 328 | | - ObjectDefineProperty(AbortSignal, 'timeout', this.#realAbortSignalTimeout); | | 329 | + ObjectDefineProperty(AbortSignal, 'timeout', ObjectSetPrototypeOf(this.#realAbortSignalTimeout, null)); | 329 | 330 | } | 330 | 331 |
| 331 | 332 | #createTimer(isInterval, callback, delay, ...args) { | @@ -633,7 +634,7 @@ class MockTimers { | 633 | 634 | ); | 634 | 635 | }, | 635 | 636 | 'Date': () => { | 636 | | - this.#nativeDateDescriptor = ObjectGetOwnPropertyDescriptor(globalThis, 'Date'); | | 637 | + this.#nativeDateDescriptor = ObjectSetPrototypeOf(ObjectGetOwnPropertyDescriptor(globalThis, 'Date'), null); | 637 | 638 | globalThis.Date = this.#createDate(); | 638 | 639 | }, | 639 | 640 | 'AbortSignal.timeout': () => { | |
|