chore: harden the promise-space Proxy targets

per @erights: this prevents non-get operations from mutating the target and using it as a communications channel.
Agoric · May 12, 2023 · ab4bc10 · ab4bc10
1 parent eec0147
commit ab4bc10
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/packages/vats/src/core/promise-space.js b/packages/vats/src/core/promise-space.js
@@ -165,7 +165,7 @@ export const makePromiseSpace = (optsOrLog = {}) => {
   /** @type {PromiseSpaceOf<T>['consume']} */
   // @ts-expect-error cast
   const consume = new Proxy(
-    {},
+    harden({}),
     {
       get: (_target, name) => {
         assert.typeof(name, 'string');
@@ -177,7 +177,7 @@ export const makePromiseSpace = (optsOrLog = {}) => {
   /** @type {PromiseSpaceOf<T>['produce']} */
   // @ts-expect-error cast
   const produce = new Proxy(
-    {},
+    harden({}),
     {
       get: (_target, name) => {
         assert.typeof(name, 'string');