stream: dont access Object.prototype.type during TransformStream init

Fixes: #46355 PR-URL: #46389 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
nodejs · Feb 2, 2023 · 7508083 · 7508083
1 parent f84de0a
commit 7508083
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/lib/internal/webstreams/transformstream.js b/lib/internal/webstreams/transformstream.js
@@ -358,6 +358,7 @@ function initializeTransformStream(
   readableSizeAlgorithm) {
 
   const writable = new WritableStream({
+    __proto__: null,
     start() { return startPromise.promise; },
     write(chunk) {
       return transformStreamDefaultSinkWriteAlgorithm(stream, chunk);
@@ -374,6 +375,7 @@ function initializeTransformStream(
   });
 
   const readable = new ReadableStream({
+    __proto__: null,
     start() { return startPromise.promise; },
     pull() {
       return transformStreamDefaultSourcePullAlgorithm(stream);

diff --git a/test/parallel/test-whatwg-transformstream.js b/test/parallel/test-whatwg-transformstream.js
@@ -186,3 +186,22 @@ class Source {
     inspect(controller, { depth: 0 }),
     /TransformStreamDefaultController \[/);
 }
+
+{
+  Object.defineProperty(Object.prototype, 'type', {
+    get: common.mustNotCall('get %Object.prototype%.type'),
+    set: common.mustNotCall('set %Object.prototype%.type'),
+    configurable: true,
+  });
+
+  new TransformStream({
+    transform(chunk, controller) {
+      controller.enqueue(chunk);
+    },
+    flush(controller) {
+      controller.terminate();
+    }
+  });
+
+  delete Object.prototype.type;
+}