foster/denoland-deno
1
0
Fork 0
mirror of https://github.com/denoland/deno.git synced 2024-12-24 08:09:08 -05:00
Code Issues Packages 1 Wiki Activity

fix(core): make errors more resistant to tampering (#15789)

Browse source 
This commit makes error objects more resistant to
prototype tampering.

This bug was found when updating the deno_std Node compatibility
layer to Node 18. The Node test 'parallel/test-assert-fail.js'
was breaking std's assertion library.

Refs: https://github.com/denoland/deno_std/pull/2585
This commit is contained in:
Colin Ihrig 2022-09-07 09:11:16 -04:00 committed by Yoshiya Hinosawa
parent 50f952fa24
commit c763514c14
No known key found for this signature in database
GPG key ID: 0E8BFAA8A5B4E92B
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
cli/tests/unit/error_test.ts
View file

@ -1,5 +1,5 @@
// Copyright 2018-2022 the Deno authors. All rights reserved. MIT license.
import { assert } from "./test_util.ts";
import { assert, assertThrows, fail } from "./test_util.ts";
Deno.test("Errors work", () => {
assert(new Deno.errors.NotFound("msg") instanceof Error);
@ -22,3 +22,11 @@ Deno.test("Errors work", () => {
assert(new Deno.errors.Busy("msg") instanceof Error);
assert(new Deno.errors.NotSupported("msg") instanceof Error);
});
Deno.test("Errors have some tamper resistance", () => {
// deno-lint-ignore no-explicit-any
(Object.prototype as any).get = () => {};
assertThrows(() => fail("test error"), Error, "test error");
// deno-lint-ignore no-explicit-any
delete (Object.prototype as any).get;
});

2
core/02_error.js
View file

@ -127,7 +127,7 @@
let callSiteEvals = ArrayPrototypeMap(callSites, evaluateCallSite);
callSiteEvals = ArrayPrototypeMap(callSiteEvals, sourceMapCallSiteEval);
ObjectDefineProperties(error, {
__callSiteEvals: { value: [], configurable: true },
__callSiteEvals: { __proto__: null, value: [], configurable: true },
});
const formattedCallSites = [];
for (const cse of callSiteEvals) {