lib: refactor to avoid prototype pollution

PR-URL: #43474 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Juan José Arboleda <[email protected]> Reviewed-By: Rich Trott <[email protected]>
nodejs · Aug 17, 2022 · a957f7b · a957f7b
1 parent 6dde810
commit a957f7b
Show file tree

Hide file tree

Showing 4 changed files with 34 additions and 5 deletions.
diff --git a/lib/internal/event_target.js b/lib/internal/event_target.js
@@ -11,6 +11,8 @@ const {
   ObjectDefineProperty,
   ObjectGetOwnPropertyDescriptor,
   ObjectGetOwnPropertyDescriptors,
+  ObjectSetPrototypeOf,
+  ObjectValues,
   ReflectApply,
   SafeArrayIterator,
   SafeFinalizationRegistry,
@@ -1062,6 +1064,12 @@ const EventEmitterMixin = (Superclass) => {
   }
   const protoProps = ObjectGetOwnPropertyDescriptors(EventEmitter.prototype);
   delete protoProps.constructor;
+  const propertiesValues = ObjectValues(protoProps);
+  for (let i = 0; i < propertiesValues.length; i++) {
+    // We want to use null-prototype objects to not rely on globally mutable
+    // %Object.prototype%.
+    ObjectSetPrototypeOf(propertiesValues[i], null);
+  }
   ObjectDefineProperties(MixedEventEmitter.prototype, protoProps);
   return MixedEventEmitter;
 };

diff --git a/lib/internal/util.js b/lib/internal/util.js
@@ -17,6 +17,7 @@ const {
   ObjectFreeze,
   ObjectPrototypeHasOwnProperty,
   ObjectSetPrototypeOf,
+  ObjectValues,
   Promise,
   ReflectApply,
   ReflectConstruct,
@@ -370,10 +371,15 @@ function promisify(original) {
     __proto__: null,
     value: fn, enumerable: false, writable: false, configurable: true
   });
-  return ObjectDefineProperties(
-    fn,
-    ObjectGetOwnPropertyDescriptors(original)
-  );
+
+  const descriptors = ObjectGetOwnPropertyDescriptors(original);
+  const propertiesValues = ObjectValues(descriptors);
+  for (let i = 0; i < propertiesValues.length; i++) {
+    // We want to use null-prototype objects to not rely on globally mutable
+    // %Object.prototype%.
+    ObjectSetPrototypeOf(propertiesValues[i], null);
+  }
+  return ObjectDefineProperties(fn, descriptors);
 }
 
 promisify.custom = kCustomPromisifiedSymbol;

diff --git a/lib/internal/worker/io.js b/lib/internal/worker/io.js
@@ -13,6 +13,7 @@ const {
   ObjectGetOwnPropertyDescriptors,
   ObjectGetPrototypeOf,
   ObjectSetPrototypeOf,
+  ObjectValues,
   ReflectApply,
   Symbol,
   SymbolFor,
@@ -95,10 +96,17 @@ const messageTypes = {
 // it inherit from NodeEventTarget, even though it is a C++ class, and b) we do
 // not provide methods that are not present in the Browser and not documented
 // on our side (e.g. stopMessagePort).
+const messagePortPrototypePropertyDescriptors = ObjectGetOwnPropertyDescriptors(MessagePort.prototype);
+const propertiesValues = ObjectValues(messagePortPrototypePropertyDescriptors);
+for (let i = 0; i < propertiesValues.length; i++) {
+  // We want to use null-prototype objects to not rely on globally mutable
+  // %Object.prototype%.
+  ObjectSetPrototypeOf(propertiesValues[i], null);
+}
 // Save a copy of the original set of methods as a shallow clone.
 const MessagePortPrototype = ObjectCreate(
   ObjectGetPrototypeOf(MessagePort.prototype),
-  ObjectGetOwnPropertyDescriptors(MessagePort.prototype));
+  messagePortPrototypePropertyDescriptors);
 // Set up the new inheritance chain.
 ObjectSetPrototypeOf(MessagePort, NodeEventTarget);
 ObjectSetPrototypeOf(MessagePort.prototype, NodeEventTarget.prototype);

diff --git a/lib/util.js b/lib/util.js
@@ -40,6 +40,7 @@ const {
   ObjectKeys,
   ObjectPrototypeToString,
   ObjectSetPrototypeOf,
+  ObjectValues,
   ReflectApply,
   StringPrototypePadStart,
 } = primordials;
@@ -324,6 +325,12 @@ function callbackify(original) {
   if (typeof descriptors.name.value === 'string') {
     descriptors.name.value += 'Callbackified';
   }
+  const propertiesValues = ObjectValues(descriptors);
+  for (let i = 0; i < propertiesValues.length; i++) {
+  // We want to use null-prototype objects to not rely on globally mutable
+  // %Object.prototype%.
+    ObjectSetPrototypeOf(propertiesValues[i], null);
+  }
   ObjectDefineProperties(callbackified, descriptors);
   return callbackified;
 }