lib: use null-prototype objects for property descriptors

Refs: #42921 PR-URL: #43270 Reviewed-By: Paolo Insogna <paolo@cowtech.it> Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Chengzhong Wu <legendecas@gmail.com> Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>
nodejs · Jun 12, 2022 · b864460 · Bigdawg001 · Apr 2, 2023 · b864460
1 parent 7d0f6da
commit b864460
Show file tree

Hide file tree

Showing 78 changed files with 446 additions and 85 deletions.
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
@@ -98,6 +98,7 @@ ObjectSetPrototypeOf(IncomingMessage.prototype, Readable.prototype);
 ObjectSetPrototypeOf(IncomingMessage, Readable);
 
 ObjectDefineProperty(IncomingMessage.prototype, 'connection', {
+  __proto__: null,
   get: function() {
     return this.socket;
   },
@@ -107,6 +108,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'connection', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
+  __proto__: null,
   get: function() {
     if (!this[kHeaders]) {
       this[kHeaders] = {};
@@ -126,6 +128,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'headersDistinct', {
+  __proto__: null,
   get: function() {
     if (!this[kHeadersDistinct]) {
       this[kHeadersDistinct] = {};
@@ -145,6 +148,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headersDistinct', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'trailers', {
+  __proto__: null,
   get: function() {
     if (!this[kTrailers]) {
       this[kTrailers] = {};
@@ -164,6 +168,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'trailers', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'trailersDistinct', {
+  __proto__: null,
   get: function() {
     if (!this[kTrailersDistinct]) {
       this[kTrailersDistinct] = {};

diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
@@ -145,6 +145,7 @@ ObjectSetPrototypeOf(OutgoingMessage.prototype, Stream.prototype);
 ObjectSetPrototypeOf(OutgoingMessage, Stream);
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableFinished', {
+  __proto__: null,
   get() {
     return (
       this.finished &&
@@ -155,31 +156,36 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'writableFinished', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableObjectMode', {
+  __proto__: null,
   get() {
     return false;
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableLength', {
+  __proto__: null,
   get() {
     return this.outputSize + (this.socket ? this.socket.writableLength : 0);
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableHighWaterMark', {
+  __proto__: null,
   get() {
     return this.socket ? this.socket.writableHighWaterMark : HIGH_WATER_MARK;
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableCorked', {
+  __proto__: null,
   get() {
     const corked = this.socket ? this.socket.writableCorked : 0;
     return corked + this[kCorked];
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, '_headers', {
+  __proto__: null,
   get: internalUtil.deprecate(function() {
     return this.getHeaders();
   }, 'OutgoingMessage.prototype._headers is deprecated', 'DEP0066'),
@@ -200,6 +206,7 @@ ObjectDefineProperty(OutgoingMessage.prototype, '_headers', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'connection', {
+  __proto__: null,
   get: function() {
     return this.socket;
   },
@@ -209,6 +216,7 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'connection', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, '_headerNames', {
+  __proto__: null,
   get: internalUtil.deprecate(function() {
     const headers = this[kOutHeaders];
     if (headers !== null) {
@@ -731,16 +739,19 @@ OutgoingMessage.prototype._implicitHeader = function _implicitHeader() {
 };
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'headersSent', {
+  __proto__: null,
   configurable: true,
   enumerable: true,
   get: function() { return !!this._header; }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableEnded', {
+  __proto__: null,
   get: function() { return this.finished; }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableNeedDrain', {
+  __proto__: null,
   get: function() {
     return !this.destroyed && !this.finished && this[kNeedDrain];
   }

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
@@ -631,6 +631,7 @@ TLSSocket.prototype._wrapHandle = function(wrap) {
 // Ref: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
 function defineHandleReading(socket, handle) {
   ObjectDefineProperty(handle, 'reading', {
+    __proto__: null,
     get: () => {
       return socket[kRes].reading;
     },

diff --git a/lib/async_hooks.js b/lib/async_hooks.js
@@ -238,12 +238,14 @@ class AsyncResource {
     }
     ObjectDefineProperties(bound, {
       'length': {
+        __proto__: null,
         configurable: true,
         enumerable: false,
         value: fn.length,
         writable: false,
       },
       'asyncResource': {
+        __proto__: null,
         configurable: true,
         enumerable: true,
         value: this,

diff --git a/lib/buffer.js b/lib/buffer.js
@@ -282,6 +282,7 @@ function Buffer(arg, encodingOrOffset, length) {
 }
 
 ObjectDefineProperty(Buffer, SymbolSpecies, {
+  __proto__: null,
   enumerable: false,
   configurable: true,
   get() { return FastBuffer; }
@@ -756,6 +757,7 @@ Buffer.byteLength = byteLength;
 
 // For backwards compatibility.
 ObjectDefineProperty(Buffer.prototype, 'parent', {
+  __proto__: null,
   enumerable: true,
   get() {
     if (!(this instanceof Buffer))
@@ -764,6 +766,7 @@ ObjectDefineProperty(Buffer.prototype, 'parent', {
   }
 });
 ObjectDefineProperty(Buffer.prototype, 'offset', {
+  __proto__: null,
   enumerable: true,
   get() {
     if (!(this instanceof Buffer))
@@ -1302,11 +1305,13 @@ module.exports = {
 
 ObjectDefineProperties(module.exports, {
   constants: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     value: constants
   },
   INSPECT_MAX_BYTES: {
+    __proto__: null,
     configurable: true,
     enumerable: true,
     get() { return INSPECT_MAX_BYTES; },

diff --git a/lib/child_process.js b/lib/child_process.js
@@ -243,6 +243,7 @@ const customPromiseExecFunction = (orig) => {
 };
 
 ObjectDefineProperty(exec, promisify.custom, {
+  __proto__: null,
   enumerable: false,
   value: customPromiseExecFunction(exec)
 });
@@ -486,6 +487,7 @@ function execFile(file, args = [], options, callback) {
 }
 
 ObjectDefineProperty(execFile, promisify.custom, {
+  __proto__: null,
   enumerable: false,
   value: customPromiseExecFunction(execFile)
 });

diff --git a/lib/crypto.js b/lib/crypto.js
@@ -259,9 +259,11 @@ function getRandomValues(array) {
 }
 
 ObjectDefineProperty(constants, 'defaultCipherList', {
+  __proto__: null,
   get() {
     const value = getOptionValue('--tls-cipher-list');
     ObjectDefineProperty(this, 'defaultCipherList', {
+      __proto__: null,
       writable: true,
       configurable: true,
       enumerable: true,
@@ -271,6 +273,7 @@ ObjectDefineProperty(constants, 'defaultCipherList', {
   },
   set(val) {
     ObjectDefineProperty(this, 'defaultCipherList', {
+      __proto__: null,
       writable: true,
       configurable: true,
       enumerable: true,
@@ -299,6 +302,7 @@ function getRandomBytesAlias(key) {
         this,
         key,
         {
+          __proto__: null,
           enumerable: false,
           configurable: true,
           writable: true,
@@ -312,6 +316,7 @@ function getRandomBytesAlias(key) {
         this,
         key,
         {
+          __proto__: null,
           enumerable: true,
           configurable: true,
           writable: true,
@@ -324,21 +329,25 @@ function getRandomBytesAlias(key) {
 
 ObjectDefineProperties(module.exports, {
   createCipher: {
+    __proto__: null,
     enumerable: false,
     value: deprecate(createCipher,
                      'crypto.createCipher is deprecated.', 'DEP0106')
   },
   createDecipher: {
+    __proto__: null,
     enumerable: false,
     value: deprecate(createDecipher,
                      'crypto.createDecipher is deprecated.', 'DEP0106')
   },
   // crypto.fips is deprecated. DEP0093. Use crypto.getFips()/crypto.setFips()
   fips: {
+    __proto__: null,
     get: getFips,
     set: setFips,
   },
   DEFAULT_ENCODING: {
+    __proto__: null,
     enumerable: false,
     configurable: true,
     get: deprecate(getDefaultEncoding,
@@ -347,26 +356,30 @@ ObjectDefineProperties(module.exports, {
                    'crypto.DEFAULT_ENCODING is deprecated.', 'DEP0091')
   },
   constants: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     value: constants
   },
 
   webcrypto: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     get() { return lazyWebCrypto().crypto; },
     set: undefined,
   },
 
   subtle: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     get() { return lazyWebCrypto().crypto.subtle; },
     set: undefined,
   },
 
   getRandomValues: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     get: () => getRandomValues,

diff --git a/lib/dgram.js b/lib/dgram.js
@@ -971,6 +971,7 @@ Socket.prototype.getSendBufferSize = function() {
 
 // Deprecated private APIs.
 ObjectDefineProperty(Socket.prototype, '_handle', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].handle;
   }, 'Socket.prototype._handle is deprecated', 'DEP0112'),
@@ -981,6 +982,7 @@ ObjectDefineProperty(Socket.prototype, '_handle', {
 
 
 ObjectDefineProperty(Socket.prototype, '_receiving', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].receiving;
   }, 'Socket.prototype._receiving is deprecated', 'DEP0112'),
@@ -991,6 +993,7 @@ ObjectDefineProperty(Socket.prototype, '_receiving', {
 
 
 ObjectDefineProperty(Socket.prototype, '_bindState', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].bindState;
   }, 'Socket.prototype._bindState is deprecated', 'DEP0112'),
@@ -1001,6 +1004,7 @@ ObjectDefineProperty(Socket.prototype, '_bindState', {
 
 
 ObjectDefineProperty(Socket.prototype, '_queue', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].queue;
   }, 'Socket.prototype._queue is deprecated', 'DEP0112'),
@@ -1011,6 +1015,7 @@ ObjectDefineProperty(Socket.prototype, '_queue', {
 
 
 ObjectDefineProperty(Socket.prototype, '_reuseAddr', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].reuseAddr;
   }, 'Socket.prototype._reuseAddr is deprecated', 'DEP0112'),
@@ -1033,6 +1038,7 @@ Socket.prototype._stopReceiving = deprecate(function() {
 // Legacy alias on the C++ wrapper object. This is not public API, so we may
 // want to runtime-deprecate it at some point. There's no hurry, though.
 ObjectDefineProperty(UDP.prototype, 'owner', {
+  __proto__: null,
   get() { return this[owner_symbol]; },
   set(v) { return this[owner_symbol] = v; }
 });

diff --git a/lib/dns.js b/lib/dns.js
@@ -198,7 +198,7 @@ function lookup(hostname, options, callback) {
 }
 
 ObjectDefineProperty(lookup, customPromisifyArgs,
-                     { value: ['address', 'family'], enumerable: false });
+                     { __proto__: null, value: ['address', 'family'], enumerable: false });
 
 
 function onlookupservice(err, hostname, service) {
@@ -243,7 +243,7 @@ function lookupService(address, port, callback) {
 }
 
 ObjectDefineProperty(lookupService, customPromisifyArgs,
-                     { value: ['hostname', 'service'], enumerable: false });
+                     { __proto__: null, value: ['hostname', 'service'], enumerable: false });
 
 
 function onresolve(err, result, ttls) {
@@ -288,7 +288,7 @@ function resolver(bindingName) {
     });
     return req;
   }
-  ObjectDefineProperty(query, 'name', { value: bindingName });
+  ObjectDefineProperty(query, 'name', { __proto__: null, value: bindingName });
   return query;
 }
 
@@ -381,6 +381,7 @@ bindDefaultResolver(module.exports, getDefaultResolver());
 
 ObjectDefineProperties(module.exports, {
   promises: {
+    __proto__: null,
     configurable: true,
     enumerable: true,
     get() {