worker: protect against user mutating well-known prototypes

PR-URL: #49270 Fixes: #49259 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matthew Aitken <[email protected]> Reviewed-By: Yagiz Nizipli <[email protected]>
nodejs · Aug 23, 2023 · bca14f8 · bca14f8
1 parent 0d080a2
commit bca14f8
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/lib/internal/worker/io.js b/lib/internal/worker/io.js
@@ -22,6 +22,7 @@ const {
 const {
   kEmptyObject,
   kEnumerableProperty,
+  setOwnProperty,
 } = require('internal/util');
 
 const {
@@ -302,15 +303,15 @@ function setupPortReferencing(port, eventEmitter, eventName) {
     if (name === eventName) removeListener(eventEmitter.listenerCount(name));
   });
   const origNewListener = eventEmitter[kNewListener];
-  eventEmitter[kNewListener] = function(size, type, ...args) {
+  setOwnProperty(eventEmitter, kNewListener, function(size, type, ...args) {
     if (type === eventName) newListener(size - 1);
     return ReflectApply(origNewListener, this, arguments);
-  };
+  });
   const origRemoveListener = eventEmitter[kRemoveListener];
-  eventEmitter[kRemoveListener] = function(size, type, ...args) {
+  setOwnProperty(eventEmitter, kRemoveListener, function(size, type, ...args) {
     if (type === eventName) removeListener(size);
     return ReflectApply(origRemoveListener, this, arguments);
-  };
+  });
 
   function newListener(size) {
     if (size === 0) {

diff --git a/test/parallel/test-worker-message-channel.js b/test/parallel/test-worker-message-channel.js
@@ -3,6 +3,9 @@ const common = require('../common');
 const assert = require('assert');
 const { MessageChannel, MessagePort, Worker } = require('worker_threads');
 
+// Asserts that freezing the EventTarget prototype does not make the internal throw.
+Object.freeze(EventTarget.prototype);
+
 {
   const channel = new MessageChannel();