process: make source map getter resistant against prototype tampering

Since this code runs during process and Worker shutdown, it should not
call user-provided code and thereby e.g. provide a way to break out of
`worker.terminate()`.
PR-URL: #30228
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Ben Coe <bencoe@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: addaleax

lib/internal/source_map/source_map_cache.js

@@ -1,5 +1,28 @@
 'use strict';
 
+const{
+JSON,
+Object: {
+create: ObjectCreate,
+keys: ObjectKeys,
+getOwnPropertyDescriptor: ObjectGetOwnPropertyDescriptor,
+},
+ObjectPrototype: {
+hasOwnProperty: ObjectHasOwnProperty
+},
+MapPrototype: {
+entries: MapEntries
+}, uncurryThis
+}=primordials;
+
+constMapIteratorNext=uncurryThis(MapEntries(newMap()).next);
+constWeakMapGet=uncurryThis(WeakMap.prototype.get);
+
+functionObjectGetValueSafe(obj,key){
+constdesc=ObjectGetOwnPropertyDescriptor(obj,key);
+returnObjectHasOwnProperty(desc,'value') ? desc.value : undefined;
+}
+
 // See https://sourcemaps.info/spec.html for SourceMap V3 specification.
 const{ Buffer }=require('buffer');
 constdebug=require('internal/util/debuglog').debuglog('source_map');
@@ -9,14 +32,14 @@ const { getOptionValue } = require('internal/options');
 const{
  normalizeReferrerURL,
 }=require('internal/modules/cjs/helpers');
-const{JSON, Object }=primordials;
 // For cjs, since Module._cache is exposed to users, we use a WeakMap
 // keyed on module, facilitating garbage collection.
 constcjsSourceMapCache=newWeakMap();
 // The esm cache is not exposed to users, so we can use a Map keyed
 // on filenames.
 constesmSourceMapCache=newMap();
 const{ fileURLToPath,URL}=require('url');
+letModule;
 
 letexperimentalSourceMaps;
 functionmaybeCacheSourceMap(filename,content,cjsModuleInstance){
@@ -40,6 +63,7 @@ function maybeCacheSourceMap(filename, content, cjsModuleInstance) {
 constdata=dataFromUrl(basePath,match.groups.sourceMappingURL);
 consturl=data ? null : match.groups.sourceMappingURL;
 if(cjsModuleInstance){
+if(!Module)Module=require('internal/modules/cjs/loader').Module;
 cjsSourceMapCache.set(cjsModuleInstance,{
  filename,
 lineLengths: lineLengths(content),
@@ -148,17 +172,27 @@ function rekeySourceMap(cjsModuleInstance, newInstance) {
 }
 }
 
+// WARNING: The `sourceMapCacheToObject` and `appendCJSCache` run during
+// shutdown. In particular, they also run when Workers are terminated, making
+// it important that they do not call out to any user-provided code, including
+// built-in prototypes that might have been tampered with.
+
 // Get serialized representation of source-map cache, this is used
 // to persist a cache of source-maps to disk when NODE_V8_COVERAGE is enabled.
 functionsourceMapCacheToObject(){
-constobj=Object.create(null);
+constobj=ObjectCreate(null);
 
-for(const[k,v]ofesmSourceMapCache){
+constit=MapEntries(esmSourceMapCache);
+letentry;
+while(!(entry=MapIteratorNext(it)).done){
+constk=entry.value[0];
+constv=entry.value[1];
 obj[k]=v;
 }
+
 appendCJSCache(obj);
 
-if(Object.keys(obj).length===0){
+if(ObjectKeys(obj).length===0){
 returnundefined;
 }else{
 returnobj;
@@ -171,23 +205,28 @@ function sourceMapCacheToObject() {
 // TODO(bcoe): this means we don't currently serialize source-maps attached
 // to error instances, only module instances.
 functionappendCJSCache(obj){
-const{ Module }=require('internal/modules/cjs/loader');
-Object.keys(Module._cache).forEach((key)=>{
-constvalue=cjsSourceMapCache.get(Module._cache[key]);
+if(!Module)return;
+constcjsModuleCache=ObjectGetValueSafe(Module,'_cache');
+constcjsModules=ObjectKeys(cjsModuleCache);
+for(leti=0;i<cjsModules.length;i++){
+constkey=cjsModules[i];
+constmodule=ObjectGetValueSafe(cjsModuleCache,key);
+constvalue=WeakMapGet(cjsSourceMapCache,module);
 if(value){
+// This is okay because `obj` has a null prototype.
 obj[`file://${key}`]={
-lineLengths: value.lineLengths,
-data: value.data,
-url: value.url
+lineLengths: ObjectGetValueSafe(value,'lineLengths'),
+data: ObjectGetValueSafe(value,'data'),
+url: ObjectGetValueSafe(value,'url')
 };
 }
-});
+}
 }
 
 // Attempt to lookup a source map, which is either attached to a file URI, or
 // keyed on an error instance.
 functionfindSourceMap(uri,error){
-const{ Module }=require('internal/modules/cjs/loader');
+if(!Module)Module=require('internal/modules/cjs/loader').Module;
 letsourceMap=cjsSourceMapCache.get(Module._cache[uri]);
 if(!uri.startsWith('file://'))uri=normalizeReferrerURL(uri);
 if(sourceMap===undefined){

test/parallel/test-worker-terminate-source-map.js

@@ -0,0 +1,40 @@
+'use strict';
+constcommon=require('../common');
+consttmpdir=require('../common/tmpdir');
+constassert=require('assert');
+
+// Attempts to test that the source map JS code run on process shutdown
+// does not call any user-defined JS code.
+
+const{ Worker, workerData, parentPort }=require('worker_threads');
+
+if(!workerData){
+tmpdir.refresh();
+process.env.NODE_V8_COVERAGE=tmpdir.path;
+
+// Count the number of some calls that should not be made.
+constcallCount=newInt32Array(newSharedArrayBuffer(4));
+constw=newWorker(__filename,{workerData: { callCount }});
+w.on('message',common.mustCall(()=>w.terminate()));
+w.on('exit',common.mustCall(()=>{
+assert.strictEqual(callCount[0],0);
+}));
+return;
+}
+
+const{ callCount }=workerData;
+
+functionincreaseCallCount(){callCount[0]++;}
+
+// Increase the call count when a forbidden method is called.
+Object.getPrototypeOf((newMap()).entries()).next=increaseCallCount;
+Map.prototype.entries=increaseCallCount;
+Object.keys=increaseCallCount;
+Object.create=increaseCallCount;
+Object.hasOwnProperty=increaseCallCount;
+Object.defineProperty(Object.prototype,'value',{
+get: increaseCallCount,
+set: increaseCallCount
+});
+
+parentPort.postMessage('done');