assert,util: harden comparison

The former algorithm used checks which were unsafe. Most of these
have been replaced with alternatives that can not be manipulated or
fooled that easily.
PR-URL: #24831
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>

Author: BridgeAR

lib/internal/util/comparisons.js

@@ -7,7 +7,14 @@ const {
  isDate,
  isMap,
  isRegExp,
- isSet
+ isSet,
+ isNativeError,
+ isBoxedPrimitive,
+ isNumberObject,
+ isStringObject,
+ isBooleanObject,
+ isBigIntObject,
+ isSymbolObject
 }=internalBinding('types');
 const{
  getOwnNonIndexProperties,
@@ -33,6 +40,13 @@ const kIsMap = 3;
 constobjectToString=uncurryThis(Object.prototype.toString);
 consthasOwnProperty=uncurryThis(Object.prototype.hasOwnProperty);
 constpropertyIsEnumerable=uncurryThis(Object.prototype.propertyIsEnumerable);
+constdateGetTime=uncurryThis(Date.prototype.getTime);
+
+constbigIntValueOf=uncurryThis(BigInt.prototype.valueOf);
+constbooleanValueOf=uncurryThis(Boolean.prototype.valueOf);
+constnumberValueOf=uncurryThis(Number.prototype.valueOf);
+constsymbolValueOf=uncurryThis(Symbol.prototype.valueOf);
+conststringValueOf=uncurryThis(String.prototype.valueOf);
 
 constobjectKeys=Object.keys;
 constgetPrototypeOf=Object.getPrototypeOf;
@@ -82,6 +96,24 @@ function isObjectOrArrayTag(tag) {
 returntag==='[object Array]'||tag==='[object Object]';
 }
 
+functionisEqualBoxedPrimitive(val1,val2){
+if(isNumberObject(val1)){
+returnisNumberObject(val2)&&
+objectIs(numberValueOf(val1),numberValueOf(val2));
+}
+if(isStringObject(val1)){
+returnisStringObject(val2)&&stringValueOf(val1)===stringValueOf(val2);
+}
+if(isBooleanObject(val1)){
+returnisBooleanObject(val2)&&
+booleanValueOf(val1)===booleanValueOf(val2);
+}
+if(isBigIntObject(val1)){
+returnisBigIntObject(val2)&&bigIntValueOf(val1)===bigIntValueOf(val2);
+}
+returnisSymbolObject(val2)&&symbolValueOf(val1)===symbolValueOf(val2);
+}
+
 // Notes: Type tags are historical [[Class]] properties that can be set by
 // FunctionTemplate::SetClassName() in C++ or Symbol.toStringTag in JS
 // and retrieved using Object.prototype.toString.call(obj) in JS
@@ -117,7 +149,7 @@ function strictDeepEqual(val1, val2, memos) {
 if(getPrototypeOf(val1)!==getPrototypeOf(val2)){
 returnfalse;
 }
-if(val1Tag==='[object Array]'){
+if(Array.isArray(val1)){
 // Check for sparse arrays and general fast path
 if(val1.length!==val2.length){
 returnfalse;
@@ -133,15 +165,14 @@ function strictDeepEqual(val1, val2, memos) {
 returnkeyCheck(val1,val2,kStrict,memos,kNoIterator);
 }
 if(isDate(val1)){
-// TODO: Make these safe.
-if(val1.getTime()!==val2.getTime()){
+if(dateGetTime(val1)!==dateGetTime(val2)){
 returnfalse;
 }
 }elseif(isRegExp(val1)){
 if(!areSimilarRegExps(val1,val2)){
 returnfalse;
 }
-}elseif(val1Tag==='[object Error]'){
+}elseif(isNativeError(val1)||val1instanceofError){
 // Do not compare the stack as it might differ even though the error itself
 // is otherwise identical. The non-enumerable name should be identical as
 // the prototype is also identical. Otherwise this is caught later on.
@@ -175,14 +206,8 @@ function strictDeepEqual(val1, val2, memos) {
 if(!areEqualArrayBuffers(val1,val2)){
 returnfalse;
 }
-// TODO: Make the valueOf checks safe.
-}elseif(typeofval1.valueOf==='function'){
-constval1Value=val1.valueOf();
-if(val1Value!==val1&&
-(typeofval2.valueOf!=='function'||
-!innerDeepEqual(val1Value,val2.valueOf(),kStrict))){
-returnfalse;
-}
+}elseif(isBoxedPrimitive(val1)&&!isEqualBoxedPrimitive(val1,val2)){
+returnfalse;
 }
 returnkeyCheck(val1,val2,kStrict,memos,kNoIterator);
 }

test/parallel/test-assert-deep.js

@@ -985,3 +985,67 @@ assert.throws(
 ' ]'
 }
 );
+
+// Verify that manipulating the `getTime()` function has no impact on the time
+// verification.
+{
+consta=newDate('2000');
+constb=newDate('2000');
+Object.defineProperty(a,'getTime',{
+value: ()=>5
+});
+assert.deepStrictEqual(a,b);
+}
+
+// Verify that extra keys will be tested for when using fake arrays.
+{
+consta={
+0: 1,
+1: 1,
+2: 'broken'
+};
+Object.setPrototypeOf(a,Object.getPrototypeOf([]));
+Object.defineProperty(a,Symbol.toStringTag,{
+value: 'Array',
+});
+Object.defineProperty(a,'length',{
+value: 2
+});
+assert.notDeepStrictEqual(a,[1,1]);
+}
+
+// Verify that changed tags will still check for the error message.
+{
+consterr=newError('foo');
+err[Symbol.toStringTag]='Foobar';
+consterr2=newError('bar');
+err2[Symbol.toStringTag]='Foobar';
+assertNotDeepOrStrict(err,err2,AssertionError);
+}
+
+// Check for non-native errors.
+{
+constsource=newError('abc');
+consterr=Object.create(
+Object.getPrototypeOf(source),Object.getOwnPropertyDescriptors(source));
+Object.defineProperty(err,'message',{value: 'foo'});
+consterr2=Object.create(
+Object.getPrototypeOf(source),Object.getOwnPropertyDescriptors(source));
+Object.defineProperty(err2,'message',{value: 'bar'});
+err[Symbol.toStringTag]='Foo';
+err2[Symbol.toStringTag]='Foo';
+assert.notDeepStrictEqual(err,err2);
+}
+
+// Verify that `valueOf` is not called for boxed primitives.
+{
+consta=newNumber(5);
+constb=newNumber(5);
+Object.defineProperty(a,'valueOf',{
+value: ()=>{thrownewError('failed');}
+});
+Object.defineProperty(b,'valueOf',{
+value: ()=>{thrownewError('failed');}
+});
+assertDeepAndStrictEqual(a,b);
+}