chore: replace __proto__ by getPrototypeOf #17386
Conversation
|
|
|
Should we add the |
|
Let's see how it goes |
|
The CI is failing: |
|
Oh ! fixed and rebased. |
mxschmitt
changed the title
| @@ -184,5 +184,6 @@ function isURL(obj: any): obj is URL { | |||
| } | |||
|
|
|||
| function isError(obj: any): obj is Error { | |||
| return obj instanceof Error || obj?.__proto__?.name === 'Error' || (obj?.__proto__ && isError(obj.__proto__)); | |||
| const proto = obj ? Object.getPrototypeOf(obj) : null; | |||
There was a problem hiding this comment.
This will fail if there is a user code like Object.getPrototypeOf = () => {};
There was a problem hiding this comment.
Oh, this is a server side code, we don't run random js here so it should be ok.
There was a problem hiding this comment.
Indeed, and obj.__proto__ was an order of magnitude less safe than Object.getPrototypeOf :)
| @@ -184,5 +184,6 @@ function isURL(obj: any): obj is URL { | |||
| } | |||
|
|
|||
| function isError(obj: any): obj is Error { | |||
| return obj instanceof Error || obj?.__proto__?.name === 'Error' || (obj?.__proto__ && isError(obj.__proto__)); | |||
| const proto = obj ? Object.getPrototypeOf(obj) : null; | |||
There was a problem hiding this comment.
Oh, this is a server side code, we don't run random js here so it should be ok.
What do you mean ? this is already tested. The behavior didn't change at all ? |
|
For the record, the more modules are going to fix this, the more node is likely to get rid of proto ! nodejs/node#31951 |
I mean a test that would fail before your change and pass after, this way we can ensure that this is documented and will not break in the future during refactoring of the code. |
Not a test, but the |
|
Maybe |
I'm fine with the change, but I don't get the idea behind the option above. We can't guarantee Playwright operation in the mode above, because we use third party modules and |
|
Some users might want to run
--disable-proto=throw|deleteoption for a hardened Node.It's easy to fix and doesn't prevent
{ __proto__: null }pattern.