buffer: make FastBuffer safe to construct

Using an explicit constructor is necessary to avoid relying on `Array.prototype[Symbol.iterator]` and `%ArrayIteratorPrototype%.next`, which can be mutated by users. PR-URL: #36587 Refs: #36428 Refs: #36532 Reviewed-By: Rich Trott <[email protected]> Reviewed-By: Luigi Pinca <[email protected]>
nodejs · Jun 11, 2021 · 9ae2a27 · 9ae2a27
1 parent 6e3a2ff
commit 9ae2a27
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
@@ -948,7 +948,14 @@ function writeFloatBackwards(val, offset = 0) {
   return offset;
 }
 
-class FastBuffer extends Uint8Array {}
+class FastBuffer extends Uint8Array {
+  // Using an explicit constructor here is necessary to avoid relying on
+  // `Array.prototype[Symbol.iterator]`, which can be mutated by users.
+  // eslint-disable-next-line no-useless-constructor
+  constructor(bufferOrLength, byteOffset, length) {
+    super(bufferOrLength, byteOffset, length);
+  }
+}
 
 function addBufferPrototypeMethods(proto) {
   proto.readBigUInt64LE = readBigUInt64LE;