Skip to content

Commit efe7474

Browse files
jasnelltargos
authored andcommitted
stream: fixup property definition to avoid prototype polution
Fixup the definitions of the properties to avoid the possibility of prototype polution on the object definitions. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #39371 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 259d091 commit efe7474

File tree

5 files changed

+58
-50
lines changed

5 files changed

+58
-50
lines changed

lib/internal/webstreams/queuingstrategies.js

+5-4
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ const {
2121
isBrandCheck,
2222
kType,
2323
kState,
24+
kEnumerableProperty,
2425
} = require('internal/webstreams/util');
2526

2627
const {
@@ -102,8 +103,8 @@ class ByteLengthQueuingStrategy {
102103
}
103104

104105
ObjectDefineProperties(ByteLengthQueuingStrategy.prototype, {
105-
highWaterMark: { enumerable: true },
106-
size: { enumerable: true },
106+
highWaterMark: kEnumerableProperty,
107+
size: kEnumerableProperty,
107108
});
108109

109110
/**
@@ -158,8 +159,8 @@ class CountQueuingStrategy {
158159
}
159160

160161
ObjectDefineProperties(CountQueuingStrategy.prototype, {
161-
highWaterMark: { enumerable: true },
162-
size: { enumerable: true },
162+
highWaterMark: kEnumerableProperty,
163+
size: kEnumerableProperty,
163164
});
164165

165166
module.exports = {

lib/internal/webstreams/readablestream.js

+27-26
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ const {
103103
nonOpStart,
104104
kType,
105105
kState,
106+
kEnumerableProperty,
106107
} = require('internal/webstreams/util');
107108

108109
const {
@@ -553,12 +554,12 @@ ObjectDefineProperties(ReadableStream.prototype, {
553554
writable: true,
554555
value: ReadableStream.prototype.values,
555556
},
556-
locked: { enumerable: true },
557-
cancel: { enumerable: true },
558-
getReader: { enumerable: true },
559-
pipeThrough: { enumerable: true },
560-
pipeTo: { enumerable: true },
561-
tee: { enumerable: true },
557+
locked: kEnumerableProperty,
558+
cancel: kEnumerableProperty,
559+
getReader: kEnumerableProperty,
560+
pipeThrough: kEnumerableProperty,
561+
pipeTo: kEnumerableProperty,
562+
tee: kEnumerableProperty,
562563
});
563564

564565
function TransferredReadableStream() {
@@ -654,9 +655,9 @@ class ReadableStreamBYOBRequest {
654655
}
655656

656657
ObjectDefineProperties(ReadableStreamBYOBRequest.prototype, {
657-
view: { enumerable: true },
658-
respond: { enumerable: true },
659-
respondWithNewView: { enumerable: true },
658+
view: kEnumerableProperty,
659+
respond: kEnumerableProperty,
660+
respondWithNewView: kEnumerableProperty,
660661
});
661662

662663
function createReadableStreamBYOBRequest(controller, view) {
@@ -801,10 +802,10 @@ class ReadableStreamDefaultReader {
801802
}
802803

803804
ObjectDefineProperties(ReadableStreamDefaultReader.prototype, {
804-
closed: { enumerable: true },
805-
read: { enumerable: true },
806-
releaseLock: { enumerable: true },
807-
cancel: { enumerable: true },
805+
closed: kEnumerableProperty,
806+
read: kEnumerableProperty,
807+
releaseLock: kEnumerableProperty,
808+
cancel: kEnumerableProperty,
808809
});
809810

810811
class ReadableStreamBYOBReader {
@@ -918,10 +919,10 @@ class ReadableStreamBYOBReader {
918919
}
919920

920921
ObjectDefineProperties(ReadableStreamBYOBReader.prototype, {
921-
closed: { enumerable: true },
922-
read: { enumerable: true },
923-
releaseLock: { enumerable: true },
924-
cancel: { enumerable: true },
922+
closed: kEnumerableProperty,
923+
read: kEnumerableProperty,
924+
releaseLock: kEnumerableProperty,
925+
cancel: kEnumerableProperty,
925926
});
926927

927928
class ReadableStreamDefaultController {
@@ -977,10 +978,10 @@ class ReadableStreamDefaultController {
977978
}
978979

979980
ObjectDefineProperties(ReadableStreamDefaultController.prototype, {
980-
desiredSize: { enumerable: true },
981-
close: { enumerable: true },
982-
enqueue: { enumerable: true },
983-
error: { enumerable: true },
981+
desiredSize: kEnumerableProperty,
982+
close: kEnumerableProperty,
983+
enqueue: kEnumerableProperty,
984+
error: kEnumerableProperty,
984985
});
985986

986987
function createReadableStreamDefaultController() {
@@ -1106,11 +1107,11 @@ class ReadableByteStreamController {
11061107
}
11071108

11081109
ObjectDefineProperties(ReadableByteStreamController.prototype, {
1109-
byobRequest: { enumerable: true },
1110-
desiredSize: { enumerable: true },
1111-
close: { enumerable: true },
1112-
enqueue: { enumerable: true },
1113-
error: { enumerable: true },
1110+
byobRequest: kEnumerableProperty,
1111+
desiredSize: kEnumerableProperty,
1112+
close: kEnumerableProperty,
1113+
enqueue: kEnumerableProperty,
1114+
error: kEnumerableProperty,
11141115
});
11151116

11161117
function createReadableByteStreamController() {

lib/internal/webstreams/transformstream.js

+7-6
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ const {
4545
nonOpFlush,
4646
kType,
4747
kState,
48+
kEnumerableProperty,
4849
} = require('internal/webstreams/util');
4950

5051
const {
@@ -226,8 +227,8 @@ class TransformStream {
226227
}
227228

228229
ObjectDefineProperties(TransformStream.prototype, {
229-
readable: { enumerable: true },
230-
writable: { enumerable: true },
230+
readable: kEnumerableProperty,
231+
writable: kEnumerableProperty,
231232
});
232233

233234
function TransferredTransformStream() {
@@ -310,10 +311,10 @@ class TransformStreamDefaultController {
310311
}
311312

312313
ObjectDefineProperties(TransformStreamDefaultController.prototype, {
313-
desiredSize: { enumerable: true },
314-
enqueue: { enumerable: true },
315-
error: { enumerable: true },
316-
terminate: { enumerable: true },
314+
desiredSize: kEnumerableProperty,
315+
enqueue: kEnumerableProperty,
316+
error: kEnumerableProperty,
317+
terminate: kEnumerableProperty,
317318
});
318319

319320
function createTransformStreamDefaultController() {

lib/internal/webstreams/util.js

+4
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,9 @@ function lazyTransfer() {
207207
return transfer;
208208
}
209209

210+
const kEnumerableProperty = ObjectCreate(null);
211+
kEnumerableProperty.enumerable = true;
212+
210213
module.exports = {
211214
ArrayBufferViewGetBuffer,
212215
ArrayBufferViewGetByteLength,
@@ -234,4 +237,5 @@ module.exports = {
234237
nonOpWrite,
235238
kType,
236239
kState,
240+
kEnumerableProperty,
237241
};

lib/internal/webstreams/writablestream.js

+15-14
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ const {
6464
nonOpWrite,
6565
kType,
6666
kState,
67+
kEnumerableProperty,
6768
} = require('internal/webstreams/util');
6869

6970
const {
@@ -280,10 +281,10 @@ class WritableStream {
280281
}
281282

282283
ObjectDefineProperties(WritableStream.prototype, {
283-
locked: { enumerable: true },
284-
abort: { enumerable: true },
285-
close: { enumerable: true },
286-
getWriter: { enumerable: true },
284+
locked: kEnumerableProperty,
285+
abort: kEnumerableProperty,
286+
close: kEnumerableProperty,
287+
getWriter: kEnumerableProperty,
287288
});
288289

289290
function TransferredWritableStream() {
@@ -469,13 +470,13 @@ class WritableStreamDefaultWriter {
469470
}
470471

471472
ObjectDefineProperties(WritableStreamDefaultWriter.prototype, {
472-
closed: { enumerable: true },
473-
ready: { enumerable: true },
474-
desiredSize: { enumerable: true },
475-
abort: { enumerable: true },
476-
close: { enumerable: true },
477-
releaseLock: { enumerable: true },
478-
write: { enumerable: true },
473+
closed: kEnumerableProperty,
474+
ready: kEnumerableProperty,
475+
desiredSize: kEnumerableProperty,
476+
abort: kEnumerableProperty,
477+
close: kEnumerableProperty,
478+
releaseLock: kEnumerableProperty,
479+
write: kEnumerableProperty,
479480
});
480481

481482
class WritableStreamDefaultController {
@@ -534,9 +535,9 @@ class WritableStreamDefaultController {
534535
}
535536

536537
ObjectDefineProperties(WritableStreamDefaultController.prototype, {
537-
abortReason: { enumerable: true },
538-
signal: { enumerable: true },
539-
error: { enumerable: true },
538+
abortReason: kEnumerableProperty,
539+
signal: kEnumerableProperty,
540+
error: kEnumerableProperty,
540541
});
541542

542543
function createWritableStreamDefaultController() {

0 commit comments

Comments
 (0)