Skip to content

Commit efe7474

Browse files
jasnelltargos
authored andcommitted
stream: fixup property definition to avoid prototype polution
Fixup the definitions of the properties to avoid the possibility of prototype polution on the object definitions. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #39371 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 259d091 commit efe7474

5 files changed

Lines changed: 58 additions & 50 deletions

File tree

‎lib/internal/webstreams/queuingstrategies.js‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ const {
2121
isBrandCheck,
2222
kType,
2323
kState,
24+
kEnumerableProperty,
2425
}=require('internal/webstreams/util');
2526

2627
const{
@@ -102,8 +103,8 @@ class ByteLengthQueuingStrategy {
102103
}
103104

104105
ObjectDefineProperties(ByteLengthQueuingStrategy.prototype,{
105-
highWaterMark: {enumerable: true},
106-
size: {enumerable: true},
106+
highWaterMark: kEnumerableProperty,
107+
size: kEnumerableProperty,
107108
});
108109

109110
/**
@@ -158,8 +159,8 @@ class CountQueuingStrategy {
158159
}
159160

160161
ObjectDefineProperties(CountQueuingStrategy.prototype,{
161-
highWaterMark: {enumerable: true},
162-
size: {enumerable: true},
162+
highWaterMark: kEnumerableProperty,
163+
size: kEnumerableProperty,
163164
});
164165

165166
module.exports={

‎lib/internal/webstreams/readablestream.js‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ const {
103103
nonOpStart,
104104
kType,
105105
kState,
106+
kEnumerableProperty,
106107
}=require('internal/webstreams/util');
107108

108109
const{
@@ -553,12 +554,12 @@ ObjectDefineProperties(ReadableStream.prototype, {
553554
writable: true,
554555
value: ReadableStream.prototype.values,
555556
},
556-
locked: {enumerable: true},
557-
cancel: {enumerable: true},
558-
getReader: {enumerable: true},
559-
pipeThrough: {enumerable: true},
560-
pipeTo: {enumerable: true},
561-
tee: {enumerable: true},
557+
locked: kEnumerableProperty,
558+
cancel: kEnumerableProperty,
559+
getReader: kEnumerableProperty,
560+
pipeThrough: kEnumerableProperty,
561+
pipeTo: kEnumerableProperty,
562+
tee: kEnumerableProperty,
562563
});
563564

564565
functionTransferredReadableStream(){
@@ -654,9 +655,9 @@ class ReadableStreamBYOBRequest {
654655
}
655656

656657
ObjectDefineProperties(ReadableStreamBYOBRequest.prototype,{
657-
view: {enumerable: true},
658-
respond: {enumerable: true},
659-
respondWithNewView: {enumerable: true},
658+
view: kEnumerableProperty,
659+
respond: kEnumerableProperty,
660+
respondWithNewView: kEnumerableProperty,
660661
});
661662

662663
functioncreateReadableStreamBYOBRequest(controller,view){
@@ -801,10 +802,10 @@ class ReadableStreamDefaultReader {
801802
}
802803

803804
ObjectDefineProperties(ReadableStreamDefaultReader.prototype,{
804-
closed: {enumerable: true},
805-
read: {enumerable: true},
806-
releaseLock: {enumerable: true},
807-
cancel: {enumerable: true},
805+
closed: kEnumerableProperty,
806+
read: kEnumerableProperty,
807+
releaseLock: kEnumerableProperty,
808+
cancel: kEnumerableProperty,
808809
});
809810

810811
classReadableStreamBYOBReader{
@@ -918,10 +919,10 @@ class ReadableStreamBYOBReader {
918919
}
919920

920921
ObjectDefineProperties(ReadableStreamBYOBReader.prototype,{
921-
closed: {enumerable: true},
922-
read: {enumerable: true},
923-
releaseLock: {enumerable: true},
924-
cancel: {enumerable: true},
922+
closed: kEnumerableProperty,
923+
read: kEnumerableProperty,
924+
releaseLock: kEnumerableProperty,
925+
cancel: kEnumerableProperty,
925926
});
926927

927928
classReadableStreamDefaultController{
@@ -977,10 +978,10 @@ class ReadableStreamDefaultController {
977978
}
978979

979980
ObjectDefineProperties(ReadableStreamDefaultController.prototype,{
980-
desiredSize: {enumerable: true},
981-
close: {enumerable: true},
982-
enqueue: {enumerable: true},
983-
error: {enumerable: true},
981+
desiredSize: kEnumerableProperty,
982+
close: kEnumerableProperty,
983+
enqueue: kEnumerableProperty,
984+
error: kEnumerableProperty,
984985
});
985986

986987
functioncreateReadableStreamDefaultController(){
@@ -1106,11 +1107,11 @@ class ReadableByteStreamController {
11061107
}
11071108

11081109
ObjectDefineProperties(ReadableByteStreamController.prototype,{
1109-
byobRequest: {enumerable: true},
1110-
desiredSize: {enumerable: true},
1111-
close: {enumerable: true},
1112-
enqueue: {enumerable: true},
1113-
error: {enumerable: true},
1110+
byobRequest: kEnumerableProperty,
1111+
desiredSize: kEnumerableProperty,
1112+
close: kEnumerableProperty,
1113+
enqueue: kEnumerableProperty,
1114+
error: kEnumerableProperty,
11141115
});
11151116

11161117
functioncreateReadableByteStreamController(){

‎lib/internal/webstreams/transformstream.js‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ const {
4545
nonOpFlush,
4646
kType,
4747
kState,
48+
kEnumerableProperty,
4849
}=require('internal/webstreams/util');
4950

5051
const{
@@ -226,8 +227,8 @@ class TransformStream {
226227
}
227228

228229
ObjectDefineProperties(TransformStream.prototype,{
229-
readable: {enumerable: true},
230-
writable: {enumerable: true},
230+
readable: kEnumerableProperty,
231+
writable: kEnumerableProperty,
231232
});
232233

233234
functionTransferredTransformStream(){
@@ -310,10 +311,10 @@ class TransformStreamDefaultController {
310311
}
311312

312313
ObjectDefineProperties(TransformStreamDefaultController.prototype,{
313-
desiredSize: {enumerable: true},
314-
enqueue: {enumerable: true},
315-
error: {enumerable: true},
316-
terminate: {enumerable: true},
314+
desiredSize: kEnumerableProperty,
315+
enqueue: kEnumerableProperty,
316+
error: kEnumerableProperty,
317+
terminate: kEnumerableProperty,
317318
});
318319

319320
functioncreateTransformStreamDefaultController(){

‎lib/internal/webstreams/util.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,9 @@ function lazyTransfer() {
207207
returntransfer;
208208
}
209209

210+
constkEnumerableProperty=ObjectCreate(null);
211+
kEnumerableProperty.enumerable=true;
212+
210213
module.exports={
211214
ArrayBufferViewGetBuffer,
212215
ArrayBufferViewGetByteLength,
@@ -234,4 +237,5 @@ module.exports = {
234237
nonOpWrite,
235238
kType,
236239
kState,
240+
kEnumerableProperty,
237241
};

‎lib/internal/webstreams/writablestream.js‎

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ const {
6464
nonOpWrite,
6565
kType,
6666
kState,
67+
kEnumerableProperty,
6768
}=require('internal/webstreams/util');
6869

6970
const{
@@ -280,10 +281,10 @@ class WritableStream {
280281
}
281282

282283
ObjectDefineProperties(WritableStream.prototype,{
283-
locked: {enumerable: true},
284-
abort: {enumerable: true},
285-
close: {enumerable: true},
286-
getWriter: {enumerable: true},
284+
locked: kEnumerableProperty,
285+
abort: kEnumerableProperty,
286+
close: kEnumerableProperty,
287+
getWriter: kEnumerableProperty,
287288
});
288289

289290
functionTransferredWritableStream(){
@@ -469,13 +470,13 @@ class WritableStreamDefaultWriter {
469470
}
470471

471472
ObjectDefineProperties(WritableStreamDefaultWriter.prototype,{
472-
closed: {enumerable: true},
473-
ready: {enumerable: true},
474-
desiredSize: {enumerable: true},
475-
abort: {enumerable: true},
476-
close: {enumerable: true},
477-
releaseLock: {enumerable: true},
478-
write: {enumerable: true},
473+
closed: kEnumerableProperty,
474+
ready: kEnumerableProperty,
475+
desiredSize: kEnumerableProperty,
476+
abort: kEnumerableProperty,
477+
close: kEnumerableProperty,
478+
releaseLock: kEnumerableProperty,
479+
write: kEnumerableProperty,
479480
});
480481

481482
classWritableStreamDefaultController{
@@ -534,9 +535,9 @@ class WritableStreamDefaultController {
534535
}
535536

536537
ObjectDefineProperties(WritableStreamDefaultController.prototype,{
537-
abortReason: {enumerable: true},
538-
signal: {enumerable: true},
539-
error: {enumerable: true},
538+
abortReason: kEnumerableProperty,
539+
signal: kEnumerableProperty,
540+
error: kEnumerableProperty,
540541
});
541542

542543
functioncreateWritableStreamDefaultController(){

0 commit comments

Comments
 (0)