Avoid hitting __proto__ #201
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
CI failure seems unrelated, I think. |
ljharb
reviewed
Jan 27, 2021
coreyfarrell
approved these changes
Feb 2, 2021
There was a problem hiding this comment.
LGTM. @ljharb thanks for the review, better to have a little noise here than deal with a regression release
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This avoids hitting
__proto__for hardened environments where__proto__is disabled.See discussion in nodejs/node#31951 and nodejs/node#32279.
To check that this works, run with
NODE_OPTIONS=--disable-proto=throw node -e 'require("./graceful-fs.js")'before and after this change.There is no reason to set
.read()proto whenObject.setPrototypeOfis not available, as no special handling ofutil.promisifyexists on those versions (even ifutil.promisifyis shipped separately somehow), so no__proto__fallback there.This change works all the way down to 0.8 afaik —
Object.getPrototypeOfis available there, andObject.setPrototypeOfis guarded. Have not checked on versions below 0.8.6.I believe this could be a semver-minor or a semver-patch.