nodejs · aduh95 · Jun 11, 2022 · Jun 15, 2022 · Jun 12, 2022 · Jun 27, 2022
diff --git a/doc/contributing/primordials.md b/doc/contributing/primordials.md
@@ -738,3 +738,27 @@ class SomeClass {
 ObjectDefineProperty(SomeClass.prototype, 'readOnlyProperty', kEnumerableProperty);
 console.log(new SomeClass().readOnlyProperty); // genuine data
 ```
+
+### Defining a `Proxy` handler
+
+When defining a `Proxy`, the handler object could be at risk of prototype
+pollution when using a plain object literal:
+
+```js
+// User-land
+Object.prototype.get = () => 'Unrelated user-provided data';
+
+// Core
+const objectToProxy = { someProperty: 'genuine value' };
+
+const proxyWithPlainObjectLiteral = new Proxy(objectToProxy, {
+  has() { return false; },
+});
+console.log(proxyWithPlainObjectLiteral.someProperty); // Unrelated user-provided data
+
+const proxyWithNullPrototypeObject = new Proxy(objectToProxy, {
+  __proto__: null,
+  has() { return false; },
+});
+console.log(proxyWithNullPrototypeObject.someProperty); // genuine value
+```
diff --git a/lib/.eslintrc.yaml b/lib/.eslintrc.yaml
@@ -116,6 +116,7 @@ rules:
     - name: SubtleCrypto
       message: Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global.
   # Custom rules in tools/eslint-rules
+  node-core/avoid-prototype-pollution: error
   node-core/lowercase-name-for-primitive: error
   node-core/non-ascii-character: error
   node-core/no-array-destructuring: error

diff --git a/lib/_http_client.js b/lib/_http_client.js
@@ -31,7 +31,7 @@ const {
   ObjectKeys,
   ObjectSetPrototypeOf,
   ReflectApply,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
   String,
   StringPrototypeCharCodeAt,
   StringPrototypeIncludes,
@@ -169,7 +169,7 @@ function ClientRequest(input, options, cb) {
 
   if (options.path) {
     const path = String(options.path);
-    if (RegExpPrototypeTest(INVALID_PATH_REGEX, path))
+    if (RegExpPrototypeExec(INVALID_PATH_REGEX, path) !== null)
       throw new ERR_UNESCAPED_CHARACTERS('Request path');
   }
 

diff --git a/lib/_http_common.js b/lib/_http_common.js
@@ -24,7 +24,7 @@
 const {
   MathMin,
   Symbol,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
 } = primordials;
 const { setImmediate } = require('timers');
 
@@ -218,7 +218,7 @@ const tokenRegExp = /^[\^_`a-zA-Z\-0-9!#$%&'*+.|~]+$/;
  * See https://tools.ietf.org/html/rfc7230#section-3.2.6
  */
 function checkIsHttpToken(val) {
-  return RegExpPrototypeTest(tokenRegExp, val);
+  return RegExpPrototypeExec(tokenRegExp, val) !== null;
 }
 
 const headerCharRegex = /[^\t\x20-\x7e\x80-\xff]/;
@@ -229,7 +229,7 @@ const headerCharRegex = /[^\t\x20-\x7e\x80-\xff]/;
  *  field-vchar    = VCHAR / obs-text
  */
 function checkInvalidHeaderChar(val) {
-  return RegExpPrototypeTest(headerCharRegex, val);
+  return RegExpPrototypeExec(headerCharRegex, val) !== null;
 }
 
 function cleanParser(parser) {

diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
@@ -33,7 +33,7 @@ const {
   ObjectValues,
   ObjectPrototypeHasOwnProperty,
   ObjectSetPrototypeOf,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
   SafeSet,
   StringPrototypeToLowerCase,
   Symbol,
@@ -542,15 +542,15 @@ function matchHeader(self, state, field, value) {
     case 'connection':
       state.connection = true;
       self._removedConnection = false;
-      if (RegExpPrototypeTest(RE_CONN_CLOSE, value))
+      if (RegExpPrototypeExec(RE_CONN_CLOSE, value) !== null)
         self._last = true;
       else
         self.shouldKeepAlive = true;
       break;
     case 'transfer-encoding':
       state.te = true;
       self._removedTE = false;
-      if (RegExpPrototypeTest(RE_TE_CHUNKED, value))
+      if (RegExpPrototypeExec(RE_TE_CHUNKED, value) !== null)
         self.chunkedEncoding = true;
       break;
     case 'content-length':

diff --git a/lib/_http_server.js b/lib/_http_server.js
@@ -26,7 +26,7 @@ const {
   Error,
   ObjectKeys,
   ObjectSetPrototypeOf,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
   Symbol,
   SymbolFor,
 } = primordials;
@@ -191,8 +191,8 @@ function ServerResponse(req) {
   this._expect_continue = false;
 
   if (req.httpVersionMajor < 1 || req.httpVersionMinor < 1) {
-    this.useChunkedEncodingByDefault = RegExpPrototypeTest(chunkExpression,
-                                                           req.headers.te);
+    this.useChunkedEncodingByDefault = RegExpPrototypeExec(chunkExpression,
+                                                           req.headers.te) !== null;
     this.shouldKeepAlive = false;
   }
 
@@ -957,7 +957,7 @@ function parserOnIncoming(server, socket, state, req, keepAlive) {
     } else if (req.headers.expect !== undefined) {
       handled = true;
 
-      if (RegExpPrototypeTest(continueExpression, req.headers.expect)) {
+      if (RegExpPrototypeExec(continueExpression, req.headers.expect) !== null) {
         res._expect_continue = true;
 
         if (server.listenerCount('checkContinue') > 0) {

diff --git a/lib/_tls_common.js b/lib/_tls_common.js
@@ -27,7 +27,7 @@ const {
   ArrayPrototypePush,
   JSONParse,
   ObjectCreate,
-  StringPrototypeReplace,
+  RegExpPrototypeSymbolReplace,
 } = primordials;
 
 const {
@@ -142,21 +142,21 @@ function translatePeerCertificate(c) {
     c.infoAccess = ObjectCreate(null);
 
     // XXX: More key validation?
-    StringPrototypeReplace(info, /([^\n:]*):([^\n]*)(?:\n|$)/g,
-                           (all, key, val) => {
-                             if (val.charCodeAt(0) === 0x22) {
-                               // The translatePeerCertificate function is only
-                               // used on internally created legacy certificate
-                               // objects, and any value that contains a quote
-                               // will always be a valid JSON string literal,
-                               // so this should never throw.
-                               val = JSONParse(val);
-                             }
-                             if (key in c.infoAccess)
-                               ArrayPrototypePush(c.infoAccess[key], val);
-                             else
-                               c.infoAccess[key] = [val];
-                           });
+    RegExpPrototypeSymbolReplace(/([^\n:]*):([^\n]*)(?:\n|$)/g, info,
+                                 (all, key, val) => {
+                                   if (val.charCodeAt(0) === 0x22) {
+                                     // The translatePeerCertificate function is only
+                                     // used on internally created legacy certificate
+                                     // objects, and any value that contains a quote
+                                     // will always be a valid JSON string literal,
+                                     // so this should never throw.
+                                     val = JSONParse(val);
+                                   }
+                                   if (key in c.infoAccess)
+                                     ArrayPrototypePush(c.infoAccess[key], val);
+                                   else
+                                     c.infoAccess[key] = [val];
+                                 });
   }
   return c;
 }

diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
@@ -31,8 +31,9 @@ const {
   ObjectSetPrototypeOf,
   ReflectApply,
   RegExp,
-  RegExpPrototypeTest,
-  StringPrototypeReplace,
+  RegExpPrototypeExec,
+  RegExpPrototypeSymbolReplace,
+  StringPrototypeReplaceAll,
   StringPrototypeSlice,
   Symbol,
   SymbolFor,
@@ -426,8 +427,8 @@ function onerror(err) {
     owner.destroy(err);
   } else if (owner._tlsOptions?.isServer &&
              owner._rejectUnauthorized &&
-             RegExpPrototypeTest(/peer did not return a certificate/,
-                                 err.message)) {
+             RegExpPrototypeExec(/peer did not return a certificate/,
+                                 err.message) !== null) {
     // Ignore server's authorization errors
     owner.destroy();
   } else {
@@ -1448,9 +1449,9 @@ Server.prototype.addContext = function(servername, context) {
     throw new ERR_TLS_REQUIRED_SERVER_NAME();
   }
 
-  const re = new RegExp('^' + StringPrototypeReplace(
-    StringPrototypeReplace(servername, /([.^$+?\-\\[\]{}])/g, '\\$1'),
-    /\*/g, '[^.]*'
+  const re = new RegExp('^' + StringPrototypeReplaceAll(
+    RegExpPrototypeSymbolReplace(/([.^$+?\-\\[\]{}])/g, servername, '\\$1'),
+    '*', '[^.]*'
   ) + '$');
   ArrayPrototypePush(this._contexts,
                      [re, tls.createSecureContext(context).context]);
@@ -1474,7 +1475,7 @@ function SNICallback(servername, callback) {
 
   for (let i = contexts.length - 1; i >= 0; --i) {
     const elem = contexts[i];
-    if (RegExpPrototypeTest(elem[0], servername)) {
+    if (RegExpPrototypeExec(elem[0], servername) !== null) {
       callback(null, elem[1]);
       return;
     }

diff --git a/lib/assert.js b/lib/assert.js
@@ -35,7 +35,8 @@ const {
   ObjectKeys,
   ObjectPrototypeIsPrototypeOf,
   ReflectApply,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
+  RegExpPrototypeSymbolReplace,
   SafeMap,
   String,
   StringPrototypeCharCodeAt,
@@ -345,7 +346,7 @@ function getErrMessage(message, fn) {
     // Always normalize indentation, otherwise the message could look weird.
     if (StringPrototypeIncludes(message, '\n')) {
       if (EOL === '\r\n') {
-        message = StringPrototypeReplace(message, /\r\n/g, '\n');
+        message = RegExpPrototypeSymbolReplace(/\r\n/g, message, '\n');
       }
       const frames = StringPrototypeSplit(message, '\n');
       message = ArrayPrototypeShift(frames);
@@ -606,7 +607,7 @@ class Comparison {
         if (actual !== undefined &&
             typeof actual[key] === 'string' &&
             isRegExp(obj[key]) &&
-            RegExpPrototypeTest(obj[key], actual[key])) {
+            RegExpPrototypeExec(obj[key], actual[key]) !== null) {
           this[key] = actual[key];
         } else {
           this[key] = obj[key];
@@ -652,7 +653,7 @@ function expectedException(actual, expected, message, fn) {
     // Handle regular expressions.
     if (isRegExp(expected)) {
       const str = String(actual);
-      if (RegExpPrototypeTest(expected, str))
+      if (RegExpPrototypeExec(expected, str) !== null)
         return;
 
       if (!message) {
@@ -687,7 +688,7 @@ function expectedException(actual, expected, message, fn) {
       for (const key of keys) {
         if (typeof actual[key] === 'string' &&
             isRegExp(expected[key]) &&
-            RegExpPrototypeTest(expected[key], actual[key])) {
+            RegExpPrototypeExec(expected[key], actual[key]) !== null) {
           continue;
         }
         compareExceptionKey(actual, expected, key, message, keys, fn);
@@ -851,7 +852,7 @@ function hasMatchingError(actual, expected) {
   if (typeof expected !== 'function') {
     if (isRegExp(expected)) {
       const str = String(actual);
-      return RegExpPrototypeTest(expected, str);
+      return RegExpPrototypeExec(expected, str) !== null;
     }
     throw new ERR_INVALID_ARG_TYPE(
       'expected', ['Function', 'RegExp'], expected
@@ -1000,7 +1001,7 @@ function internalMatch(string, regexp, message, fn) {
   }
   const match = fn === assert.match;
   if (typeof string !== 'string' ||
-      RegExpPrototypeTest(regexp, string) !== match) {
+      RegExpPrototypeExec(regexp, string) !== null !== match) {
     if (message instanceof Error) {
       throw message;
     }

diff --git a/lib/buffer.js b/lib/buffer.js
@@ -37,8 +37,8 @@ const {
   ObjectDefineProperties,
   ObjectDefineProperty,
   ObjectSetPrototypeOf,
+  RegExpPrototypeSymbolReplace,
   StringPrototypeCharCodeAt,
-  StringPrototypeReplace,
   StringPrototypeSlice,
   StringPrototypeToLowerCase,
   StringPrototypeTrim,
@@ -840,8 +840,8 @@ Buffer.prototype[customInspectSymbol] = function inspect(recurseTimes, ctx) {
   const max = INSPECT_MAX_BYTES;
   const actualMax = MathMin(max, this.length);
   const remaining = this.length - max;
-  let str = StringPrototypeTrim(StringPrototypeReplace(
-    this.hexSlice(0, actualMax), /(.{2})/g, '$1 '));
+  let str = StringPrototypeTrim(RegExpPrototypeSymbolReplace(
+    /(.{2})/g, this.hexSlice(0, actualMax), '$1 '));
   if (remaining > 0)
     str += ` ... ${remaining} more byte${remaining > 1 ? 's' : ''}`;
   // Inspect special properties as well, if possible.

diff --git a/lib/child_process.js b/lib/child_process.js
@@ -36,7 +36,7 @@ const {
   ObjectAssign,
   ObjectDefineProperty,
   ObjectPrototypeHasOwnProperty,
-  RegExpPrototypeTest,
+  RegExpPrototypeExec,
   SafeSet,
   StringPrototypeSlice,
   StringPrototypeToUpperCase,
@@ -592,7 +592,7 @@ function normalizeSpawnArguments(file, args, options) {
       else
         file = process.env.comspec || 'cmd.exe';
       // '/d /s /c' is used only for cmd.exe.
-      if (RegExpPrototypeTest(/^(?:.*\\)?cmd(?:\.exe)?$/i, file)) {
+      if (RegExpPrototypeExec(/^(?:.*\\)?cmd(?:\.exe)?$/i, file) !== null) {
         args = ['/d', '/s', '/c', `"${command}"`];
         windowsVerbatimArguments = true;
       } else {

diff --git a/lib/crypto.js b/lib/crypto.js
@@ -297,6 +297,7 @@ ObjectDefineProperties(module.exports, {
   // Aliases for randomBytes are deprecated.
   // The ecosystem needs those to exist for backwards compatibility.
   prng: {
+    __proto__: null,
     enumerable: false,
     configurable: true,
     writable: true,
@@ -305,6 +306,7 @@ ObjectDefineProperties(module.exports, {
       randomBytes
   },
   pseudoRandomBytes: {
+    __proto__: null,
     enumerable: false,
     configurable: true,
     writable: true,
@@ -314,6 +316,7 @@ ObjectDefineProperties(module.exports, {
       randomBytes
   },
   rng: {
+    __proto__: null,
     enumerable: false,
     configurable: true,
     writable: true,

diff --git a/lib/internal/blob.js b/lib/internal/blob.js
@@ -9,8 +9,8 @@ const {
   PromiseReject,
   SafePromisePrototypeFinally,
   ReflectConstruct,
+  RegExpPrototypeExec,
   RegExpPrototypeSymbolReplace,
-  RegExpPrototypeTest,
   StringPrototypeToLowerCase,
   StringPrototypeSplit,
   Symbol,
@@ -164,7 +164,7 @@ class Blob {
     this[kLength] = length;
 
     type = `${type}`;
-    this[kType] = RegExpPrototypeTest(disallowedTypeCharacters, type) ?
+    this[kType] = RegExpPrototypeExec(disallowedTypeCharacters, type) !== null ?
       '' : StringPrototypeToLowerCase(type);
 
     // eslint-disable-next-line no-constructor-return
@@ -246,7 +246,7 @@ class Blob {
     end |= 0;
 
     contentType = `${contentType}`;
-    if (RegExpPrototypeTest(disallowedTypeCharacters, contentType)) {
+    if (RegExpPrototypeExec(disallowedTypeCharacters, contentType) !== null) {
       contentType = '';
     } else {
       contentType = StringPrototypeToLowerCase(contentType);