From af796c712e4fed06e9b4cc034d1bf7a746ad8103 Mon Sep 17 00:00:00 2001
From: Aras Abbasi <aras.abbasi@googlemail.com>
Date: Mon, 5 Feb 2024 12:53:30 +0100
Subject: [PATCH] fix: webidl.brandcheck non strict should throw (#2683)

* fix: webidl.brandcheck non strict should throw

* add brandcheck test

* add one more test case

* one more test for globalThis.Headers

* remove test

* add brandcheck for all cases
---
 lib/fetch/webidl.js    |  10 ++--
 test/cookie/cookies.js | 110 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 117 insertions(+), 3 deletions(-)

diff --git a/lib/fetch/webidl.js b/lib/fetch/webidl.js
index cb6bcc37db9..d639b8b7668 100644
--- a/lib/fetch/webidl.js
+++ b/lib/fetch/webidl.js
@@ -34,10 +34,14 @@ webidl.errors.invalidArgument = function (context) {
 
 // https://webidl.spec.whatwg.org/#implements
 webidl.brandCheck = function (V, I, opts = undefined) {
-  if (opts?.strict !== false && !(V instanceof I)) {
-    throw new TypeError('Illegal invocation')
+  if (opts?.strict !== false) {
+    if (!(V instanceof I)) {
+      throw new TypeError('Illegal invocation')
+    }
   } else {
-    return V?.[Symbol.toStringTag] === I.prototype[Symbol.toStringTag]
+    if (V?.[Symbol.toStringTag] !== I.prototype[Symbol.toStringTag]) {
+      throw new TypeError('Illegal invocation')
+    }
   }
 }
 
diff --git a/test/cookie/cookies.js b/test/cookie/cookies.js
index 7859c6b2618..d6fed72be16 100644
--- a/test/cookie/cookies.js
+++ b/test/cookie/cookies.js
@@ -599,3 +599,113 @@ test('Set-Cookie parser', () => {
   headers = new Headers()
   assert.deepEqual(getSetCookies(headers), [])
 })
+
+test('Cookie setCookie throws if headers is not of type Headers', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'CustomHeaders'
+  }
+  const headers = new Headers()
+  assert.throws(
+    () => {
+      setCookie(headers, {
+        name: 'key',
+        value: 'Cat',
+        httpOnly: true,
+        secure: true,
+        maxAge: 3
+      })
+    },
+    new TypeError('Illegal invocation')
+  )
+})
+
+test('Cookie setCookie does not throw if headers is an instance of undici owns Headers class', () => {
+  const headers = new Headers()
+  setCookie(headers, {
+    name: 'key',
+    value: 'Cat',
+    httpOnly: true,
+    secure: true,
+    maxAge: 3
+  })
+})
+
+test('Cookie setCookie does not throw if headers is an instance of the global Headers class', () => {
+  const headers = new globalThis.Headers()
+  setCookie(headers, {
+    name: 'key',
+    value: 'Cat',
+    httpOnly: true,
+    secure: true,
+    maxAge: 3
+  })
+})
+
+test('Cookie getCookies throws if headers is not of type Headers', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'CustomHeaders'
+  }
+  const headers = new Headers()
+  assert.throws(
+    () => {
+      getCookies(headers)
+    },
+    new TypeError('Illegal invocation')
+  )
+})
+
+test('Cookie getCookies does not throw if headers is an instance of undici owns Headers class', () => {
+  const headers = new Headers()
+  getCookies(headers)
+})
+
+test('Cookie getCookie does not throw if headers is an instance of the global Headers class', () => {
+  const headers = new globalThis.Headers()
+  getCookies(headers)
+})
+
+test('Cookie getSetCookies throws if headers is not of type Headers', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'CustomHeaders'
+  }
+  const headers = new Headers({ 'set-cookie': 'Space=Cat' })
+  assert.throws(
+    () => {
+      getSetCookies(headers)
+    },
+    new TypeError('Illegal invocation')
+  )
+})
+
+test('Cookie getSetCookies does not throw if headers is an instance of undici owns Headers class', () => {
+  const headers = new Headers({ 'set-cookie': 'Space=Cat' })
+  getSetCookies(headers)
+})
+
+test('Cookie setCookie does not throw if headers is an instance of the global Headers class', () => {
+  const headers = new globalThis.Headers({ 'set-cookie': 'Space=Cat' })
+  getSetCookies(headers)
+})
+
+test('Cookie deleteCookie throws if headers is not of type Headers', () => {
+  class Headers {
+    [Symbol.toStringTag] = 'CustomHeaders'
+  }
+  const headers = new Headers()
+  assert.throws(
+    () => {
+      deleteCookie(headers, 'deno')
+    },
+    new TypeError('Illegal invocation')
+  )
+})
+
+test('Cookie deleteCookie does not throw if headers is an instance of undici owns Headers class', () => {
+  const headers = new Headers()
+  deleteCookie(headers, 'deno')
+})
+
+test('Cookie getCookie does not throw if headers is an instance of the global Headers class', () => {
+  const headers = new globalThis.Headers()
+  deleteCookie(headers, 'deno')
+})