Fix Proxy get trap being bypassed for properties named "revoke"#2667
Merged
Conversation
lahma
enabled auto-merge (squash)
July 13, 2026 12:52
JsProxy.Get contained a special case that skipped the get trap entirely
for any property named "revoke", so
`new Proxy({}, { get: () => 'trapped' }).revoke` returned undefined
instead of 'trapped'. Per the spec (Proxy [[Get]],
https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver)
there is no such exception: the trap must be called for every property key.
The bypass is dead legacy from the original Reflect & Proxy
implementation (f898860, 2019), where revocation was wired through
dynamic property lookups on the proxy itself. Today
ProxyConstructor.Revocable captures the JsProxy instance in a closure
and nulls its target/handler slots directly, so nothing depends on
"revoke" resolving against the target.
Cross-checked with V8 (Node v24.18.0):
`new Proxy({}, {get: () => 'trapped'}).revoke` prints "trapped", and
property access on a revoked proxy still throws
"TypeError: Cannot perform 'get' on a proxy that has been revoked".
Adds tests for the trapped "revoke" property and for the TypeError on
property access after revocation.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EsHuKuE4UihKZp5HYapDHE
lahma
force-pushed
the
proxy-revoke-bypass
branch
from
July 13, 2026 13:10
db9d535 to
ce772df
Compare
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
JsProxy.Getspecial-cased any property namedrevoketo skip the get trap entirely:The bypass dates back to the original Proxy implementation (#681), where revocation was wired through dynamic property lookups. Today
Proxy.revocablecaptures the proxy instance directly in the revoke closure, so the special case only remains as an observable spec violation (Proxy [[Get]] has no such exception).test262 has no coverage for a trapped property literally named
revoke(verified), which is why this never surfaced. Cross-checked against node 24 / V8: trap is called, and revoked-proxy access errors match.Tests: get trap fires for
revoke; revocable round-trip and revoked-access TypeError still covered.🤖 Generated with Claude Code
https://claude.ai/code/session_01EsHuKuE4UihKZp5HYapDHE