Skip to content

Commit

Permalink
stream: fixup property definition to avoid prototype polution
Browse files Browse the repository at this point in the history
Fixup the definitions of the properties to avoid the possibility
of prototype polution on the object definitions.

Signed-off-by: James M Snell <jasnell@gmail.com>

PR-URL: #39371
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Robert Nagy <ronagy@icloud.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
  • Loading branch information
jasnell committed Jul 13, 2021
1 parent a99c230 commit 2cc13ad
Show file tree
Hide file tree
Showing 5 changed files with 58 additions and 50 deletions.
9 changes: 5 additions & 4 deletions lib/internal/webstreams/queuingstrategies.js
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ const {
isBrandCheck,
kType,
kState,
kEnumerableProperty,
} = require('internal/webstreams/util');

const {
Expand Down Expand Up @@ -102,8 +103,8 @@ class ByteLengthQueuingStrategy {
}

ObjectDefineProperties(ByteLengthQueuingStrategy.prototype, {
highWaterMark: { enumerable: true },
size: { enumerable: true },
highWaterMark: kEnumerableProperty,
size: kEnumerableProperty,
});

/**
Expand Down Expand Up @@ -158,8 +159,8 @@ class CountQueuingStrategy {
}

ObjectDefineProperties(CountQueuingStrategy.prototype, {
highWaterMark: { enumerable: true },
size: { enumerable: true },
highWaterMark: kEnumerableProperty,
size: kEnumerableProperty,
});

module.exports = {
Expand Down
53 changes: 27 additions & 26 deletions lib/internal/webstreams/readablestream.js
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,7 @@ const {
nonOpStart,
kType,
kState,
kEnumerableProperty,
} = require('internal/webstreams/util');

const {
Expand Down Expand Up @@ -553,12 +554,12 @@ ObjectDefineProperties(ReadableStream.prototype, {
writable: true,
value: ReadableStream.prototype.values,
},
locked: { enumerable: true },
cancel: { enumerable: true },
getReader: { enumerable: true },
pipeThrough: { enumerable: true },
pipeTo: { enumerable: true },
tee: { enumerable: true },
locked: kEnumerableProperty,
cancel: kEnumerableProperty,
getReader: kEnumerableProperty,
pipeThrough: kEnumerableProperty,
pipeTo: kEnumerableProperty,
tee: kEnumerableProperty,
});

function TransferredReadableStream() {
Expand Down Expand Up @@ -654,9 +655,9 @@ class ReadableStreamBYOBRequest {
}

ObjectDefineProperties(ReadableStreamBYOBRequest.prototype, {
view: { enumerable: true },
respond: { enumerable: true },
respondWithNewView: { enumerable: true },
view: kEnumerableProperty,
respond: kEnumerableProperty,
respondWithNewView: kEnumerableProperty,
});

function createReadableStreamBYOBRequest(controller, view) {
Expand Down Expand Up @@ -801,10 +802,10 @@ class ReadableStreamDefaultReader {
}

ObjectDefineProperties(ReadableStreamDefaultReader.prototype, {
closed: { enumerable: true },
read: { enumerable: true },
releaseLock: { enumerable: true },
cancel: { enumerable: true },
closed: kEnumerableProperty,
read: kEnumerableProperty,
releaseLock: kEnumerableProperty,
cancel: kEnumerableProperty,
});

class ReadableStreamBYOBReader {
Expand Down Expand Up @@ -918,10 +919,10 @@ class ReadableStreamBYOBReader {
}

ObjectDefineProperties(ReadableStreamBYOBReader.prototype, {
closed: { enumerable: true },
read: { enumerable: true },
releaseLock: { enumerable: true },
cancel: { enumerable: true },
closed: kEnumerableProperty,
read: kEnumerableProperty,
releaseLock: kEnumerableProperty,
cancel: kEnumerableProperty,
});

class ReadableStreamDefaultController {
Expand Down Expand Up @@ -977,10 +978,10 @@ class ReadableStreamDefaultController {
}

ObjectDefineProperties(ReadableStreamDefaultController.prototype, {
desiredSize: { enumerable: true },
close: { enumerable: true },
enqueue: { enumerable: true },
error: { enumerable: true },
desiredSize: kEnumerableProperty,
close: kEnumerableProperty,
enqueue: kEnumerableProperty,
error: kEnumerableProperty,
});

function createReadableStreamDefaultController() {
Expand Down Expand Up @@ -1106,11 +1107,11 @@ class ReadableByteStreamController {
}

ObjectDefineProperties(ReadableByteStreamController.prototype, {
byobRequest: { enumerable: true },
desiredSize: { enumerable: true },
close: { enumerable: true },
enqueue: { enumerable: true },
error: { enumerable: true },
byobRequest: kEnumerableProperty,
desiredSize: kEnumerableProperty,
close: kEnumerableProperty,
enqueue: kEnumerableProperty,
error: kEnumerableProperty,
});

function createReadableByteStreamController() {
Expand Down
13 changes: 7 additions & 6 deletions lib/internal/webstreams/transformstream.js
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ const {
nonOpFlush,
kType,
kState,
kEnumerableProperty,
} = require('internal/webstreams/util');

const {
Expand Down Expand Up @@ -226,8 +227,8 @@ class TransformStream {
}

ObjectDefineProperties(TransformStream.prototype, {
readable: { enumerable: true },
writable: { enumerable: true },
readable: kEnumerableProperty,
writable: kEnumerableProperty,
});

function TransferredTransformStream() {
Expand Down Expand Up @@ -310,10 +311,10 @@ class TransformStreamDefaultController {
}

ObjectDefineProperties(TransformStreamDefaultController.prototype, {
desiredSize: { enumerable: true },
enqueue: { enumerable: true },
error: { enumerable: true },
terminate: { enumerable: true },
desiredSize: kEnumerableProperty,
enqueue: kEnumerableProperty,
error: kEnumerableProperty,
terminate: kEnumerableProperty,
});

function createTransformStreamDefaultController() {
Expand Down
4 changes: 4 additions & 0 deletions lib/internal/webstreams/util.js
Original file line number Diff line number Diff line change
Expand Up @@ -207,6 +207,9 @@ function lazyTransfer() {
return transfer;
}

const kEnumerableProperty = ObjectCreate(null);
kEnumerableProperty.enumerable = true;

module.exports = {
ArrayBufferViewGetBuffer,
ArrayBufferViewGetByteLength,
Expand Down Expand Up @@ -234,4 +237,5 @@ module.exports = {
nonOpWrite,
kType,
kState,
kEnumerableProperty,
};
29 changes: 15 additions & 14 deletions lib/internal/webstreams/writablestream.js
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ const {
nonOpWrite,
kType,
kState,
kEnumerableProperty,
} = require('internal/webstreams/util');

const {
Expand Down Expand Up @@ -280,10 +281,10 @@ class WritableStream {
}

ObjectDefineProperties(WritableStream.prototype, {
locked: { enumerable: true },
abort: { enumerable: true },
close: { enumerable: true },
getWriter: { enumerable: true },
locked: kEnumerableProperty,
abort: kEnumerableProperty,
close: kEnumerableProperty,
getWriter: kEnumerableProperty,
});

function TransferredWritableStream() {
Expand Down Expand Up @@ -469,13 +470,13 @@ class WritableStreamDefaultWriter {
}

ObjectDefineProperties(WritableStreamDefaultWriter.prototype, {
closed: { enumerable: true },
ready: { enumerable: true },
desiredSize: { enumerable: true },
abort: { enumerable: true },
close: { enumerable: true },
releaseLock: { enumerable: true },
write: { enumerable: true },
closed: kEnumerableProperty,
ready: kEnumerableProperty,
desiredSize: kEnumerableProperty,
abort: kEnumerableProperty,
close: kEnumerableProperty,
releaseLock: kEnumerableProperty,
write: kEnumerableProperty,
});

class WritableStreamDefaultController {
Expand Down Expand Up @@ -534,9 +535,9 @@ class WritableStreamDefaultController {
}

ObjectDefineProperties(WritableStreamDefaultController.prototype, {
abortReason: { enumerable: true },
signal: { enumerable: true },
error: { enumerable: true },
abortReason: kEnumerableProperty,
signal: kEnumerableProperty,
error: kEnumerableProperty,
});

function createWritableStreamDefaultController() {
Expand Down

0 comments on commit 2cc13ad

Please sign in to comment.