diff --git a/lib/internal/console/constructor.js b/lib/internal/console/constructor.js index af027cf3b3cc59..355e0a0f2bf445 100644 --- a/lib/internal/console/constructor.js +++ b/lib/internal/console/constructor.js @@ -9,6 +9,7 @@ const { Boolean, Error, Map, + ObjectCreate, ObjectDefineProperties, ObjectDefineProperty, ObjectKeys, @@ -532,7 +533,7 @@ const consoleMethods = { return final([iterKey, valuesKey], [getIndexArray(length), values]); } - const map = {}; + const map = ObjectCreate(null); let hasPrimitives = false; const valuesKeyArray = []; const indexKeyArray = ObjectKeys(tabularData); diff --git a/test/parallel/test-console-table.js b/test/parallel/test-console-table.js index e2b3b71b628718..8a2ed71335de68 100644 --- a/test/parallel/test-console-table.js +++ b/test/parallel/test-console-table.js @@ -276,3 +276,18 @@ test({ foo: '你好', bar: 'hello' }, ` │ bar │ 'hello' │ └─────────┴─────────┘ `); + +// Regression test for prototype pollution via console.table. Earlier versions +// of Node.js created an object with a non-null prototype within console.table +// and then wrote to object[column][index], which lead to an error as well as +// modifications to Object.prototype. +test([{ foo: 10 }, { foo: 20 }], ['__proto__'], ` +┌─────────┬───────────┐ +│ (index) │ __proto__ │ +├─────────┼───────────┤ +│ 0 │ │ +│ 1 │ │ +└─────────┴───────────┘ +`); +assert.strictEqual('0' in Object.prototype, false); +assert.strictEqual('1' in Object.prototype, false);