From c6197bcc5df72217d883a39cdc28d68f478bde5b Mon Sep 17 00:00:00 2001
From: "Mark S. Miller" <erights@gmail.com>
Date: Mon, 27 Dec 2021 21:00:24 -0800
Subject: [PATCH] fix: harden where needed

---
 .../test/unitTests/test-shareHolders.js       | 42 +++++++++++--------
 packages/zoe/src/cleanProposal.js             |  9 ++--
 2 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/packages/governance/test/unitTests/test-shareHolders.js b/packages/governance/test/unitTests/test-shareHolders.js
index e882edec89b..1f1b78ba15d 100644
--- a/packages/governance/test/unitTests/test-shareHolders.js
+++ b/packages/governance/test/unitTests/test-shareHolders.js
@@ -59,19 +59,21 @@ const attest = (addr, amountLiened, expiration) => {
  * @param {Timestamp} deadline
  */
 const makeDefaultBallotSpec = (issue, positions, timer, deadline) => {
-  const questionSpec = looksLikeQuestionSpec({
-    method: ChoiceMethod.UNRANKED,
-    issue,
-    positions,
-    electionType: ElectionType.ELECTION,
-    maxChoices: 1,
-    closingRule: {
-      timer,
-      deadline,
-    },
-    quorumRule: QuorumRule.NO_QUORUM,
-    tieOutcome: positions[1],
-  });
+  const questionSpec = looksLikeQuestionSpec(
+    harden({
+      method: ChoiceMethod.UNRANKED,
+      issue,
+      positions,
+      electionType: ElectionType.ELECTION,
+      maxChoices: 1,
+      closingRule: {
+        timer,
+        deadline,
+      },
+      quorumRule: QuorumRule.NO_QUORUM,
+      tieOutcome: positions[1],
+    }),
+  );
 
   return questionSpec;
 };
@@ -94,9 +96,13 @@ const offerToVoteSeat = (attestationMint, publicElectorate, attestation) => {
     give: { Attestation: attestation },
     want: {},
   });
-  return E(zoe).offer(E(publicElectorate).makeVoterInvitation(), proposal, {
-    Attestation: attestation1,
-  });
+  return E(zoe).offer(
+    E(publicElectorate).makeVoterInvitation(),
+    proposal,
+    harden({
+      Attestation: attestation1,
+    }),
+  );
 };
 
 /**
@@ -114,10 +120,10 @@ const voterFacet = (mint, publicFacet, attestAmmount) => {
  */
 const addDeposeQuestion = async (timer, creatorFacet) => {
   const depose = harden({ text: 'Replace the CEO?' });
-  const deposePositions = [
+  const deposePositions = harden([
     harden({ text: 'Yes, replace' }),
     harden({ text: 'no change' }),
-  ];
+  ]);
   const deposeSpec = makeDefaultBallotSpec(depose, deposePositions, timer, 2n);
   const { publicFacet: deposeCounter, questionHandle } = await E(
     creatorFacet,
diff --git a/packages/zoe/src/cleanProposal.js b/packages/zoe/src/cleanProposal.js
index cf316c3264d..c1b951b76aa 100644
--- a/packages/zoe/src/cleanProposal.js
+++ b/packages/zoe/src/cleanProposal.js
@@ -38,12 +38,13 @@ export const assertKeywordName = keyword => {
 };
 
 /**
- * @param {{[name: string]: any}} keywordRecord
+ * @param {{[name: string]: any}} uncleanKeywordRecord
  * @returns {string[]}
  */
-export const cleanKeywords = keywordRecord => {
-  assertRecord(keywordRecord, 'keywordRecord');
-  const keywords = ownKeys(keywordRecord);
+export const cleanKeywords = uncleanKeywordRecord => {
+  harden(uncleanKeywordRecord);
+  assertRecord(uncleanKeywordRecord, 'keywordRecord');
+  const keywords = ownKeys(uncleanKeywordRecord);
 
   // Assert all names are ascii identifiers starting with
   // an upper case letter.