iframe-proxy

aduh95 · 2026-07-01T18:20:47Z

We have a lint rule for when the descriptor is a plain object, but it doesn't cover case where the descriptor is stored as a variable, and some instances were missing the null prototype.

As a reminder, setting __proto__: null is mandatory for property descriptor to avoid the code failing if e.g. both Object.prototype.value and Object.prototype.get are set to anything.

node/doc/contributing/primordials.md

Lines 712 to 767 in 42fd49a

    
           ### Defining object own properties 
        
           When defining property descriptor (to add or update an own property to a 
        
           JavaScript object), be sure to always use a null-prototype object to avoid 
        
           prototype pollution. 
        
           ```js 
        
           // User-land 
        
           Object.prototype.get = function get() {}; 
        
           // Core 
        
           try { 
        
             ObjectDefineProperty({}, 'someProperty', { value: 0 }); 
        
           } catch (err) { 
        
             console.log(err); // TypeError: Invalid property descriptor. 
        
           } 
        
           ``` 
        
           ```js 
        
           // User-land 
        
           Object.prototype.get = function get() {}; 
        
           // Core 
        
           ObjectDefineProperty({}, 'someProperty', { __proto__: null, value: 0 }); 
        
           console.log('no errors'); // no errors. 
        
           ``` 
        
           Same applies when trying to modify an existing property, e.g. trying to make a 
        
           read-only property enumerable: 
        
           ```js 
        
           // User-land 
        
           Object.prototype.value = 'Unrelated user-provided data'; 
        
           // Core 
        
           class SomeClass { 
        
             get readOnlyProperty() { return 'genuine data'; } 
        
           } 
        
           ObjectDefineProperty(SomeClass.prototype, 'readOnlyProperty', { enumerable: true }); 
        
           console.log(new SomeClass().readOnlyProperty); // Unrelated user-provided data 
        
           ``` 
        
           ```js 
        
           // User-land 
        
           Object.prototype.value = 'Unrelated user-provided data'; 
        
           // Core 
        
           const kEnumerableProperty = { __proto__: null, enumerable: true }; 
        
           // In core, use const {kEnumerableProperty} = require('internal/util'); 
        
           class SomeClass { 
        
             get readOnlyProperty() { return 'genuine data'; } 
        
           } 
        
           ObjectDefineProperty(SomeClass.prototype, 'readOnlyProperty', kEnumerableProperty); 
        
           console.log(new SomeClass().readOnlyProperty); // genuine data 
        
           ```

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>

nodejs-github-bot · 2026-07-01T18:20:52Z

Review requested:

@nodejs/http2
@nodejs/net
@nodejs/test_runner

nodejs-github-bot · 2026-07-02T07:43:17Z

CI: https://ci.nodejs.org/job/node-test-pull-request/74501/

Renegade334 · 2026-07-03T07:27:40Z

+  const descriptors = ObjectGetOwnPropertyDescriptors(source);
+
+  const descValues = ObjectValues(descriptors);
+  for (let i = 0; i < descValues.length; ++i) {
+    ObjectSetPrototypeOf(descValues[i], null);
+  }
+
+  ObjectDefineProperties(target, descriptors);


Should we move this to internal/util? Looks like we're using it at least twice 🙂

lib: use __proto__: null when calling ObjectDefineProperty

49ff323

Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com>

nodejs-github-bot added lib / src Issues and PRs related to general changes in the lib or src directory. needs-ci PRs that need a full CI run. labels Jul 1, 2026

ljharb approved these changes Jul 2, 2026

View reviewed changes

aduh95 added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. request-ci Add this label to start a Jenkins CI on a PR. labels Jul 2, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Jul 2, 2026

bjohansebas approved these changes Jul 2, 2026

View reviewed changes

Renegade334 approved these changes Jul 3, 2026

View reviewed changes

aduh95 added the commit-queue Add this label to land a pull request using GitHub Actions. label Jul 3, 2026

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

lib: use `proto: null` when calling `ObjectDefineProperty`#64239

lib: use `proto: null` when calling `ObjectDefineProperty`#64239
aduh95 wants to merge 1 commit into
nodejs:mainfrom
aduh95:proto-null-define

aduh95 commented Jul 1, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Jul 1, 2026

Uh oh!

nodejs-github-bot commented Jul 2, 2026

Uh oh!

Renegade334 Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

	### Defining object own properties

	When defining property descriptor (to add or update an own property to a
	JavaScript object), be sure to always use a null-prototype object to avoid
	prototype pollution.

	```js
	// User-land
	Object.prototype.get = function get() {};

	// Core
	try {
	ObjectDefineProperty({}, 'someProperty', { value: 0 });
	} catch (err) {
	console.log(err); // TypeError: Invalid property descriptor.
	}
	```

	```js
	// User-land
	Object.prototype.get = function get() {};

	// Core
	ObjectDefineProperty({}, 'someProperty', { __proto__: null, value: 0 });
	console.log('no errors'); // no errors.
	```

	Same applies when trying to modify an existing property, e.g. trying to make a
	read-only property enumerable:

	```js
	// User-land
	Object.prototype.value = 'Unrelated user-provided data';

	// Core
	class SomeClass {
	get readOnlyProperty() { return 'genuine data'; }
	}
	ObjectDefineProperty(SomeClass.prototype, 'readOnlyProperty', { enumerable: true });
	console.log(new SomeClass().readOnlyProperty); // Unrelated user-provided data
	```

	```js
	// User-land
	Object.prototype.value = 'Unrelated user-provided data';

	// Core
	const kEnumerableProperty = { __proto__: null, enumerable: true };
	// In core, use const {kEnumerableProperty} = require('internal/util');
	class SomeClass {
	get readOnlyProperty() { return 'genuine data'; }
	}
	ObjectDefineProperty(SomeClass.prototype, 'readOnlyProperty', kEnumerableProperty);
	console.log(new SomeClass().readOnlyProperty); // genuine data
	```

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Uh oh!

Conversation

aduh95 commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Jul 1, 2026

Uh oh!

nodejs-github-bot commented Jul 2, 2026

Uh oh!

Renegade334 Jul 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

aduh95 commented Jul 1, 2026 •

edited

Loading