Deno/deno
1
0
Fork 0
mirror of https://github.com/denoland/deno.git synced 2024-11-22 04:51:22 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

fix(core): make errors more resistant to tampering (#15789)

Browse Source 
This commit makes error objects more resistant to
prototype tampering.

This bug was found when updating the deno_std Node compatibility
layer to Node 18. The Node test 'parallel/test-assert-fail.js'
was breaking std's assertion library.

Refs: https://github.com/denoland/deno_std/pull/2585
This commit is contained in:
Colin Ihrig 2022-09-07 09:11:16 -04:00 committed by GitHub
parent 027d4d433d
commit 3b1204eb2d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
cli/tests/unit/error_test.ts
View File

@ -1,5 +1,5 @@
// Copyright 2018-2022 the Deno authors. All rights reserved. MIT license.
import { assert } from "./test_util.ts";
import { assert, assertThrows, fail } from "./test_util.ts";
Deno.test("Errors work", () => {
assert(new Deno.errors.NotFound("msg") instanceof Error);
@ -22,3 +22,11 @@ Deno.test("Errors work", () => {
assert(new Deno.errors.Busy("msg") instanceof Error);
assert(new Deno.errors.NotSupported("msg") instanceof Error);
});
Deno.test("Errors have some tamper resistance", () => {
// deno-lint-ignore no-explicit-any
(Object.prototype as any).get = () => {};
assertThrows(() => fail("test error"), Error, "test error");
// deno-lint-ignore no-explicit-any
delete (Object.prototype as any).get;
});

2
core/02_error.js
View File

@ -127,7 +127,7 @@
let callSiteEvals = ArrayPrototypeMap(callSites, evaluateCallSite);
callSiteEvals = ArrayPrototypeMap(callSiteEvals, sourceMapCallSiteEval);
ObjectDefineProperties(error, {
__callSiteEvals: { value: [], configurable: true },
__callSiteEvals: { __proto__: null, value: [], configurable: true },
});
const formattedCallSites = [];
for (const cse of callSiteEvals) {