Remove Object.prototype.__proto__

cli/tests/integration_tests.rs

@@ -1426,6 +1426,11 @@ itest!(fix_js_imports {
   output: "fix_js_imports.ts.out",
 });
 
+itest!(proto_exploit {
+  args: "run proto_exploit.js",
+  output: "proto_exploit.js.out",
+});
+
 #[test]
 fn cafile_fetch() {
   use deno::http_cache::url_to_filename;

cli/tests/proto_exploit.js

@@ -0,0 +1,5 @@
+const payload = `{ "__proto__": null }`;
+const obj = {};
+console.log("Before: " + obj);
+Object.assign(obj, JSON.parse(payload));
+console.log("After: " + obj);

cli/tests/proto_exploit.js.out

@@ -0,0 +1,2 @@
+Before: [object Object]
+After: [object Object]

deno_typescript/lib.rs

@@ -204,7 +204,12 @@ pub fn mksnapshot_bundle(
   js_check(
     isolate.execute(&bundle_filename.to_string_lossy(), bundle_source_code),
   );
-  let script = &format!("__instantiate(\"{}\");", main_module_name);
+  // instantiate the bundle and delete __proto__ for security reasons
+  // this is intentionally not compliant with ECMA-262 Annex B.2.2.1.
+  let script = &format!(
+    "__instantiate(\"{}\");\n\ndelete Object.prototype.__proto__;",
+    main_module_name
+  );
   js_check(isolate.execute("anon", script));
   write_snapshot(isolate, snapshot_filename)?;
   Ok(())