lib: use __proto__: null when calling ObjectDefineProperty

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: #64239
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Author: aduh95

lib/internal/debugger/inspect_repl.js

@@ -19,15 +19,17 @@ const {
  JSONStringify,
  MathMax,
  ObjectAssign,
+ ObjectDefineProperties,
  ObjectDefineProperty,
+ ObjectGetOwnPropertyDescriptors,
  ObjectKeys,
+ ObjectSetPrototypeOf,
  ObjectValues,
  Promise,
  PromisePrototypeThen,
  PromiseResolve,
  PromiseWithResolvers,
  ReflectGetOwnPropertyDescriptor,
- ReflectOwnKeys,
  RegExpPrototypeExec,
  SafeMap,
  SafePromiseAllReturnArrayLike,
@@ -347,18 +349,20 @@ class ScopeSnapshot {
 }
 
 functioncopyOwnProperties(target,source){
-ArrayPrototypeForEach(
-ReflectOwnKeys(source),
-(prop)=>{
-constdesc=ReflectGetOwnPropertyDescriptor(source,prop);
-ObjectDefineProperty(target,prop,desc);
-});
+constdescriptors=ObjectGetOwnPropertyDescriptors(source);
+
+constdescValues=ObjectValues(descriptors);
+for(leti=0;i<descValues.length;++i){
+ObjectSetPrototypeOf(descValues[i],null);
+}
+
+ObjectDefineProperties(target,descriptors);
 }
 
 functionaliasProperties(target,mapping){
 ArrayPrototypeForEach(ObjectKeys(mapping),(key)=>{
 constdesc=ReflectGetOwnPropertyDescriptor(target,key);
-ObjectDefineProperty(target,mapping[key],desc);
+ObjectDefineProperty(target,mapping[key],{__proto__: null, ...desc});
 });
 }
 

lib/internal/http2/core.js

@@ -3246,6 +3246,7 @@ function handleHeaderContinue(headers) {
 }
 
 constsetTimeoutValue={
+__proto__: null,
 configurable: true,
 enumerable: true,
 writable: true,

lib/internal/per_context/domexception.js

@@ -196,7 +196,7 @@ for (const { 0: name, 1: codeName, 2: value } of [
 // There are some more error names, but since they don't have codes assigned,
 // we don't need to care about them.
 ]){
-constdesc={enumerable: true, value };
+constdesc={__proto__: null,enumerable: true, value };
 ObjectDefineProperty(DOMException,codeName,desc);
 ObjectDefineProperty(DOMExceptionPrototype,codeName,desc);
 nameToCodeMap.set(name,value);

lib/internal/test_runner/mock/mock.js

@@ -7,10 +7,14 @@ const {
  FunctionPrototypeBind,
  FunctionPrototypeCall,
  ObjectAssign,
+ ObjectDefineProperties,
  ObjectDefineProperty,
  ObjectGetOwnPropertyDescriptor,
+ ObjectGetOwnPropertyDescriptors,
  ObjectGetPrototypeOf,
  ObjectKeys,
+ ObjectSetPrototypeOf,
+ ObjectValues,
  Proxy,
  ReflectApply,
  ReflectConstruct,
@@ -146,7 +150,7 @@ class MockFunctionContext {
 
 if(typeofmethodName==='string'){
 // This is an object method spy.
-ObjectDefineProperty(object,methodName,descriptor);
+ObjectDefineProperty(object,methodName,{__proto__: null, ...descriptor});
 }else{
 // This is a bare function spy. There isn't much to do here but make
 // the mock call the original function.
@@ -880,13 +884,14 @@ function normalizeModuleMockOptions(options) {
 
 
 functioncopyOwnProperties(from,to){
-constkeys=ObjectKeys(from);
+constdescriptors=ObjectGetOwnPropertyDescriptors(from);
 
-for(leti=0;i<keys.length;++i){
-constkey=keys[i];
-constdescriptor=ObjectGetOwnPropertyDescriptor(from,key);
-ObjectDefineProperty(to,key,descriptor);
+constdescValues=ObjectValues(descriptors);
+for(leti=0;i<descValues.length;++i){
+ObjectSetPrototypeOf(descValues[i],null);
 }
+
+ObjectDefineProperties(to,descriptors);
 }
 
 functionsetupSharedModuleState(){

lib/internal/test_runner/mock/mock_timers.js

@@ -13,6 +13,7 @@ const {
  ObjectDefineProperty,
  ObjectGetOwnPropertyDescriptor,
  ObjectGetOwnPropertyDescriptors,
+ ObjectSetPrototypeOf,
  PromiseWithResolvers,
  Symbol,
  SymbolDispose,
@@ -325,7 +326,7 @@ class MockTimers {
 }
 
  #restoreOriginalAbortSignalTimeout(){
-ObjectDefineProperty(AbortSignal,'timeout',this.#realAbortSignalTimeout);
+ObjectDefineProperty(AbortSignal,'timeout',ObjectSetPrototypeOf(this.#realAbortSignalTimeout,null));
 }
 
  #createTimer(isInterval,callback,delay, ...args){
@@ -633,7 +634,7 @@ class MockTimers {
 );
 },
 'Date': ()=>{
-this.#nativeDateDescriptor =ObjectGetOwnPropertyDescriptor(globalThis,'Date');
+this.#nativeDateDescriptor =ObjectSetPrototypeOf(ObjectGetOwnPropertyDescriptor(globalThis,'Date'),null);
 globalThis.Date=this.#createDate();
 },
 'AbortSignal.timeout': ()=>{