util: limit inspect to only show own properties

BridgeAR · RafaelGSS · commit 1dd15c950207 · 2026-01-13T10:04:51.000-03:00
`Error`'s `cause` and `errors` properties would be visible even if these were not own properties. This is changed to align with all other parts of the `inspect` handling. Fixes: #60717 PR-URL: #61032 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
@@ -1955,15 +1955,15 @@ function formatError(err, constructor, tag, ctx, keys) {
   }
   name ??= 'Error';
 
-  if ('cause' in err &&
+  if (ObjectPrototypeHasOwnProperty(err, 'cause') &&
       (keys.length === 0 || !ArrayPrototypeIncludes(keys, 'cause'))) {
     ArrayPrototypePush(keys, 'cause');
   }
 
   // Print errors aggregated into AggregateError
   try {
     const errors = err.errors;
-    if (ArrayIsArray(errors) &&
+    if (ArrayIsArray(errors) && ObjectPrototypeHasOwnProperty(err, 'errors') &&
       (keys.length === 0 || !ArrayPrototypeIncludes(keys, 'errors'))) {
       ArrayPrototypePush(keys, 'errors');
     }
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
@@ -688,6 +688,53 @@ assert.strictEqual(util.inspect(-5e-324), '-5e-324');
   );
 }
 
+{
+  // No own errors or cause property.
+  const { stackTraceLimit } = Error;
+  Error.stackTraceLimit = 0;
+
+  const e1 = new Error('e1');
+  const e2 = new TypeError('e2');
+  const e3 = false;
+
+  const errors = [e1, e2, e3];
+  const aggregateError = new AggregateError(errors, 'Foobar');
+
+  assert.deepStrictEqual(aggregateError.errors, errors);
+  assert.strictEqual(
+    util.inspect(aggregateError),
+    '[AggregateError: Foobar] {\n  [errors]: [ [Error: e1], [TypeError: e2], false ]\n}'
+  );
+
+
+  const custom = new Error('No own errors property');
+  Object.setPrototypeOf(custom, aggregateError);
+
+  assert.strictEqual(
+    util.inspect(custom),
+    '[AggregateError: No own errors property]'
+  );
+
+  const cause = [new Error('cause')];
+  const causeError = new TypeError('Foobar', { cause: [new Error('cause')] });
+
+  assert.strictEqual(
+    util.inspect(causeError),
+    '[TypeError: Foobar] { [cause]: [ [Error: cause] ] }'
+  );
+
+  const custom2 = new Error('No own cause property');
+  Object.setPrototypeOf(custom2, causeError);
+
+  assert.deepStrictEqual(custom2.cause, cause);
+  assert.strictEqual(
+    util.inspect(custom2),
+    '[TypeError: No own cause property]'
+  );
+
+  Error.stackTraceLimit = stackTraceLimit;
+}
+
 {
   const tmp = Error.stackTraceLimit;
   // Force stackTraceLimit = 0 for this test, but make it non-enumerable

Original file line number	Diff line number	Diff line change
`@@ -1955,15 +1955,15 @@ function formatError(err, constructor, tag, ctx, keys) {`
`1955`	`1955`	`}`
`1956`	`1956`	`name ??= 'Error';`
`1957`	`1957`
`1958`		`- if ('cause' in err &&`
	`1958`	`+ if (ObjectPrototypeHasOwnProperty(err, 'cause') &&`
`1959`	`1959`	`(keys.length === 0 \|\| !ArrayPrototypeIncludes(keys, 'cause'))) {`
`1960`	`1960`	`ArrayPrototypePush(keys, 'cause');`
`1961`	`1961`	`}`
`1962`	`1962`
`1963`	`1963`	`// Print errors aggregated into AggregateError`
`1964`	`1964`	`try {`
`1965`	`1965`	`const errors = err.errors;`
`1966`		`- if (ArrayIsArray(errors) &&`
	`1966`	`+ if (ArrayIsArray(errors) && ObjectPrototypeHasOwnProperty(err, 'errors') &&`
`1967`	`1967`	`(keys.length === 0 \|\| !ArrayPrototypeIncludes(keys, 'errors'))) {`
`1968`	`1968`	`ArrayPrototypePush(keys, 'errors');`
`1969`	`1969`	`}`