lib: brand check event handler property receivers

Event handler properties defined by `defineEventHandler` should check
if the receiver is a valid `EventTarget`.
PR-URL: #44483
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: legendecas

lib/internal/event_target.js

@@ -34,7 +34,7 @@ const {
 ERR_INVALID_THIS,
 }
 }=require('internal/errors');
-const{ validateObject, validateString }=require('internal/validators');
+const{ validateObject, validateString, validateInternalField}=require('internal/validators');
 
 const{
  customInspectSymbol,
@@ -492,6 +492,7 @@ function initEventTarget(self) {
 self[kEvents]=newSafeMap();
 self[kMaxEventTargetListeners]=EventEmitter.defaultMaxListeners;
 self[kMaxEventTargetListenersWarned]=false;
+self[kHandlers]=newSafeMap();
 }
 
 classEventTarget{
@@ -1021,34 +1022,46 @@ function makeEventHandler(handler) {
 
 functiondefineEventHandler(emitter,name){
 // 8.1.5.1 Event handlers - basically `on[eventName]` attributes
-ObjectDefineProperty(emitter,`on${name}`,{
+constpropName=`on${name}`;
+functionget(){
+validateInternalField(this,kHandlers,'EventTarget');
+returnthis[kHandlers]?.get(name)?.handler??null;
+}
+ObjectDefineProperty(get,'name',{
 __proto__: null,
-get(){
-returnthis[kHandlers]?.get(name)?.handler??null;
-},
-set(value){
-if(!this[kHandlers]){
-this[kHandlers]=newSafeMap();
+value: `get ${propName}`,
+});
+
+functionset(value){
+validateInternalField(this,kHandlers,'EventTarget');
+letwrappedHandler=this[kHandlers]?.get(name);
+if(wrappedHandler){
+if(typeofwrappedHandler.handler==='function'){
+this[kEvents].get(name).size--;
+constsize=this[kEvents].get(name).size;
+this[kRemoveListener](size,name,wrappedHandler.handler,false);
 }
-letwrappedHandler=this[kHandlers]?.get(name);
-if(wrappedHandler){
-if(typeofwrappedHandler.handler==='function'){
-this[kEvents].get(name).size--;
-constsize=this[kEvents].get(name).size;
-this[kRemoveListener](size,name,wrappedHandler.handler,false);
-}
-wrappedHandler.handler=value;
-if(typeofwrappedHandler.handler==='function'){
-this[kEvents].get(name).size++;
-constsize=this[kEvents].get(name).size;
-this[kNewListener](size,name,value,false,false,false,false);
-}
-}else{
-wrappedHandler=makeEventHandler(value);
-this.addEventListener(name,wrappedHandler);
+wrappedHandler.handler=value;
+if(typeofwrappedHandler.handler==='function'){
+this[kEvents].get(name).size++;
+constsize=this[kEvents].get(name).size;
+this[kNewListener](size,name,value,false,false,false,false);
 }
-this[kHandlers].set(name,wrappedHandler);
-},
+}else{
+wrappedHandler=makeEventHandler(value);
+this.addEventListener(name,wrappedHandler);
+}
+this[kHandlers].set(name,wrappedHandler);
+}
+ObjectDefineProperty(set,'name',{
+__proto__: null,
+value: `set ${propName}`,
+});
+
+ObjectDefineProperty(emitter,propName,{
+__proto__: null,
+ get,
+ set,
 configurable: true,
 enumerable: true
 });

lib/internal/validators.js

@@ -418,6 +418,12 @@ function validateLinkHeaderValue(value, name) {
 }
 }
 
+constvalidateInternalField=hideStackFrames((object,fieldKey,className)=>{
+if(typeofobject!=='object'||object===null||!ObjectPrototypeHasOwnProperty(object,fieldKey)){
+thrownewERR_INVALID_ARG_TYPE('this',className,object);
+}
+});
+
 module.exports={
  isInt32,
  isUint32,
@@ -440,5 +446,6 @@ module.exports = {
  validateUndefined,
  validateUnion,
  validateAbortSignal,
- validateLinkHeaderValue
+ validateLinkHeaderValue,
+ validateInternalField,
 };