util: limit inspect to only show own properties

BridgeAR · aduh95 · commit 6acc9d75ec11 · 2026-01-19T19:19:26.000+01:00
`Error`'s `cause` and `errors` properties would be visible even if these were not own properties. This is changed to align with all other parts of the `inspect` handling. Fixes: #60717 PR-URL: #61032 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
@@ -1703,15 +1703,15 @@ function formatError(err, constructor, tag, ctx, keys) {
   }
   name ??= 'Error';
 
-  if ('cause' in err &&
+  if (ObjectPrototypeHasOwnProperty(err, 'cause') &&
       (keys.length === 0 || !ArrayPrototypeIncludes(keys, 'cause'))) {
     ArrayPrototypePush(keys, 'cause');
   }
 
   // Print errors aggregated into AggregateError
   try {
     const errors = err.errors;
-    if (ArrayIsArray(errors) &&
+    if (ArrayIsArray(errors) && ObjectPrototypeHasOwnProperty(err, 'errors') &&
       (keys.length === 0 || !ArrayPrototypeIncludes(keys, 'errors'))) {
       ArrayPrototypePush(keys, 'errors');
     }
diff --git a/test/parallel/test-util-inspect.js b/test/parallel/test-util-inspect.js
@@ -688,6 +688,53 @@ assert.strictEqual(util.inspect(-5e-324), '-5e-324');
   );
 }
 
+{
+  // No own errors or cause property.
+  const { stackTraceLimit } = Error;
+  Error.stackTraceLimit = 0;
+
+  const e1 = new Error('e1');
+  const e2 = new TypeError('e2');
+  const e3 = false;
+
+  const errors = [e1, e2, e3];
+  const aggregateError = new AggregateError(errors, 'Foobar');
+
+  assert.deepStrictEqual(aggregateError.errors, errors);
+  assert.strictEqual(
+    util.inspect(aggregateError),
+    '[AggregateError: Foobar] {\n  [errors]: [ [Error: e1], [TypeError: e2], false ]\n}'
+  );
+
+
+  const custom = new Error('No own errors property');
+  Object.setPrototypeOf(custom, aggregateError);
+
+  assert.strictEqual(
+    util.inspect(custom),
+    '[AggregateError: No own errors property]'
+  );
+
+  const cause = [new Error('cause')];
+  const causeError = new TypeError('Foobar', { cause: [new Error('cause')] });
+
+  assert.strictEqual(
+    util.inspect(causeError),
+    '[TypeError: Foobar] { [cause]: [ [Error: cause] ] }'
+  );
+
+  const custom2 = new Error('No own cause property');
+  Object.setPrototypeOf(custom2, causeError);
+
+  assert.deepStrictEqual(custom2.cause, cause);
+  assert.strictEqual(
+    util.inspect(custom2),
+    '[TypeError: No own cause property]'
+  );
+
+  Error.stackTraceLimit = stackTraceLimit;
+}
+
 {
   const tmp = Error.stackTraceLimit;
   // Force stackTraceLimit = 0 for this test, but make it non-enumerable

Original file line number	Diff line number	Diff line change
`@@ -1703,15 +1703,15 @@ function formatError(err, constructor, tag, ctx, keys) {`
`1703`	`1703`	`}`
`1704`	`1704`	`name ??= 'Error';`
`1705`	`1705`
`1706`		`- if ('cause' in err &&`
	`1706`	`+ if (ObjectPrototypeHasOwnProperty(err, 'cause') &&`
`1707`	`1707`	`(keys.length === 0 \|\| !ArrayPrototypeIncludes(keys, 'cause'))) {`
`1708`	`1708`	`ArrayPrototypePush(keys, 'cause');`
`1709`	`1709`	`}`
`1710`	`1710`
`1711`	`1711`	`// Print errors aggregated into AggregateError`
`1712`	`1712`	`try {`
`1713`	`1713`	`const errors = err.errors;`
`1714`		`- if (ArrayIsArray(errors) &&`
	`1714`	`+ if (ArrayIsArray(errors) && ObjectPrototypeHasOwnProperty(err, 'errors') &&`
`1715`	`1715`	`(keys.length === 0 \|\| !ArrayPrototypeIncludes(keys, 'errors'))) {`
`1716`	`1716`	`ArrayPrototypePush(keys, 'errors');`
`1717`	`1717`	`}`