Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 0985ef8

Browse filesBrowse files
aduh95RafaelGSS
aduh95
authored and
RafaelGSS
committed
tools: add ArrayPrototypeConcat to the list of primordials to avoid
PR-URL: #44445 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 069a30b commit 0985ef8
Copy full SHA for 0985ef8

File tree

Expand file treeCollapse file tree

10 files changed

+52
-29
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

10 files changed

+52
-29
lines changed
Open diff view settings
Collapse file

‎lib/internal/bootstrap/node.js‎

Copy file name to clipboardExpand all lines: lib/internal/bootstrap/node.js
+6-6Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ setupPrepareStackTrace();
5656

5757
const {
5858
Array,
59-
ArrayPrototypeConcat,
6059
ArrayPrototypeFill,
60+
ArrayPrototypePushApply,
6161
FunctionPrototypeCall,
6262
JSONParse,
6363
ObjectDefineProperty,
@@ -162,11 +162,11 @@ const rawMethods = internalBinding('process_methods');
162162

163163
process.getActiveResourcesInfo = function() {
164164
const timerCounts = internalTimers.getTimerCounts();
165-
return ArrayPrototypeConcat(
166-
rawMethods._getActiveRequestsInfo(),
167-
rawMethods._getActiveHandlesInfo(),
168-
ArrayPrototypeFill(new Array(timerCounts.timeoutCount), 'Timeout'),
169-
ArrayPrototypeFill(new Array(timerCounts.immediateCount), 'Immediate'));
165+
const info = rawMethods._getActiveRequestsInfo();
166+
ArrayPrototypePushApply(info, rawMethods._getActiveHandlesInfo());
167+
ArrayPrototypePushApply(info, ArrayPrototypeFill(new Array(timerCounts.timeoutCount), 'Timeout'));
168+
ArrayPrototypePushApply(info, ArrayPrototypeFill(new Array(timerCounts.immediateCount), 'Immediate'));
169+
return info;
170170
};
171171

172172
// TODO(joyeecheung): remove these
Collapse file

‎lib/internal/debugger/inspect.js‎

Copy file name to clipboardExpand all lines: lib/internal/debugger/inspect.js
+3-4Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
'use strict';
22

33
const {
4-
ArrayPrototypeConcat,
54
ArrayPrototypeForEach,
65
ArrayPrototypeJoin,
76
ArrayPrototypeMap,
87
ArrayPrototypePop,
8+
ArrayPrototypePushApply,
99
ArrayPrototypeShift,
1010
ArrayPrototypeSlice,
1111
FunctionPrototypeBind,
@@ -82,9 +82,8 @@ const debugRegex = /Debugger listening on ws:\/\/\[?(.+?)\]?:(\d+)\//;
8282
async function runScript(script, scriptArgs, inspectHost, inspectPort,
8383
childPrint) {
8484
await portIsFree(inspectHost, inspectPort);
85-
const args = ArrayPrototypeConcat(
86-
[`--inspect-brk=${inspectPort}`, script],
87-
scriptArgs);
85+
const args = [`--inspect-brk=${inspectPort}`, script];
86+
ArrayPrototypePushApply(args, scriptArgs);
8887
const child = spawn(process.execPath, args);
8988
child.stdout.setEncoding('utf8');
9089
child.stderr.setEncoding('utf8');
Collapse file

‎lib/internal/main/print_help.js‎

Copy file name to clipboardExpand all lines: lib/internal/main/print_help.js
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ for (const key of ObjectKeys(types))
3131
// Environment variables are parsed ad-hoc throughout the code base,
3232
// so we gather the documentation here.
3333
const { hasIntl, hasSmallICU, hasNodeOptions } = internalBinding('config');
34+
// eslint-disable-next-line node-core/avoid-prototype-pollution
3435
const envVars = new SafeMap(ArrayPrototypeConcat([
3536
['FORCE_COLOR', { helpText: "when set to 'true', 1, 2, 3, or an empty " +
3637
'string causes NO_COLOR and NODE_DISABLE_COLORS to be ignored.' }],
Collapse file

‎lib/internal/modules/cjs/loader.js‎

Copy file name to clipboardExpand all lines: lib/internal/modules/cjs/loader.js
+12-4Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323

2424
const {
2525
ArrayIsArray,
26-
ArrayPrototypeConcat,
2726
ArrayPrototypeFilter,
2827
ArrayPrototypeIncludes,
2928
ArrayPrototypeIndexOf,
@@ -667,7 +666,13 @@ Module._findPath = function(request, paths, isMain) {
667666
Module._pathCache[cacheKey] = filename;
668667
return filename;
669668
}
670-
reportModuleNotFoundToWatchMode(basePath, ArrayPrototypeConcat([''], exts));
669+
670+
if (exts === undefined) {
671+
exts = [''];
672+
} else {
673+
ArrayPrototypeUnshift(exts, '');
674+
}
675+
reportModuleNotFoundToWatchMode(basePath, exts);
671676
}
672677

673678
return false;
@@ -781,9 +786,12 @@ Module._resolveLookupPaths = function(request, parent) {
781786
StringPrototypeCharAt(request, 1) !== '/' &&
782787
(!isWindows || StringPrototypeCharAt(request, 1) !== '\\'))) {
783788

784-
let paths = modulePaths;
789+
let paths;
785790
if (parent?.paths?.length) {
786-
paths = ArrayPrototypeConcat(parent.paths, paths);
791+
paths = ArrayPrototypeSlice(modulePaths);
792+
ArrayPrototypeUnshiftApply(paths, parent.paths);
793+
} else {
794+
paths = modulePaths;
787795
}
788796

789797
debug('looking for %j in %j', request, paths);
Collapse file

‎lib/internal/modules/esm/resolve.js‎

Copy file name to clipboardExpand all lines: lib/internal/modules/esm/resolve.js
+6-6Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
const {
44
ArrayIsArray,
5-
ArrayPrototypeConcat,
65
ArrayPrototypeJoin,
6+
ArrayPrototypePush,
77
ArrayPrototypeShift,
88
JSONStringify,
99
ObjectGetOwnPropertyNames,
@@ -957,11 +957,11 @@ function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
957957
)
958958
)
959959
) {
960-
throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, ArrayPrototypeConcat(
961-
'file',
962-
'data',
963-
experimentalNetworkImports ? ['https', 'http'] : [],
964-
));
960+
const schemes = ['file', 'data'];
961+
if (experimentalNetworkImports) {
962+
ArrayPrototypePush(schemes, 'https', 'http');
963+
}
964+
throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, schemes);
965965
}
966966
}
967967

Collapse file

‎lib/internal/perf/observe.js‎

Copy file name to clipboardExpand all lines: lib/internal/perf/observe.js
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ const {
99
ArrayPrototypePushApply,
1010
ArrayPrototypeSlice,
1111
ArrayPrototypeSort,
12-
ArrayPrototypeConcat,
1312
Error,
1413
MathMax,
1514
MathMin,
@@ -513,7 +512,10 @@ function filterBufferMapByNameAndType(name, type) {
513512
// Unrecognized type;
514513
return [];
515514
} else {
516-
bufferList = ArrayPrototypeConcat(markEntryBuffer, measureEntryBuffer, resourceTimingBuffer);
515+
bufferList = [];
516+
ArrayPrototypePushApply(bufferList, markEntryBuffer);
517+
ArrayPrototypePushApply(bufferList, measureEntryBuffer);
518+
ArrayPrototypePushApply(bufferList, resourceTimingBuffer);
517519
}
518520
if (name !== undefined) {
519521
bufferList = ArrayPrototypeFilter(bufferList, (buffer) => buffer.name === name);
Collapse file

‎lib/internal/util/inspector.js‎

Copy file name to clipboardExpand all lines: lib/internal/util/inspector.js
+4-5Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
'use strict';
22

33
const {
4-
ArrayPrototypeConcat,
54
ArrayPrototypeSome,
5+
ArrayPrototypePushApply,
66
FunctionPrototypeBind,
77
ObjectDefineProperty,
88
ObjectKeys,
@@ -69,10 +69,9 @@ function installConsoleExtensions(commandLineApi) {
6969
const { makeRequireFunction } = require('internal/modules/helpers');
7070
const consoleAPIModule = new CJSModule('<inspector console>');
7171
const cwd = tryGetCwd();
72-
consoleAPIModule.paths = ArrayPrototypeConcat(
73-
CJSModule._nodeModulePaths(cwd),
74-
CJSModule.globalPaths
75-
);
72+
consoleAPIModule.paths = [];
73+
ArrayPrototypePushApply(consoleAPIModule.paths, CJSModule._nodeModulePaths(cwd));
74+
ArrayPrototypePushApply(consoleAPIModule.paths, CJSModule.globalPaths);
7675
commandLineApi.require = makeRequireFunction(consoleAPIModule);
7776
}
7877

Collapse file

‎lib/repl.js‎

Copy file name to clipboardExpand all lines: lib/repl.js
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@
4343
'use strict';
4444

4545
const {
46-
ArrayPrototypeConcat,
4746
ArrayPrototypeFilter,
4847
ArrayPrototypeFindIndex,
4948
ArrayPrototypeForEach,
@@ -52,6 +51,7 @@ const {
5251
ArrayPrototypeMap,
5352
ArrayPrototypePop,
5453
ArrayPrototypePush,
54+
ArrayPrototypePushApply,
5555
ArrayPrototypeReverse,
5656
ArrayPrototypeShift,
5757
ArrayPrototypeSlice,
@@ -1331,7 +1331,9 @@ function complete(line, callback) {
13311331
} else if (RegExpPrototypeExec(/^\.\.?\//, completeOn) !== null) {
13321332
paths = [process.cwd()];
13331333
} else {
1334-
paths = ArrayPrototypeConcat(module.paths, CJSModule.globalPaths);
1334+
paths = [];
1335+
ArrayPrototypePushApply(paths, module.paths);
1336+
ArrayPrototypePushApply(paths, CJSModule.globalPaths);
13351337
}
13361338

13371339
ArrayPrototypeForEach(paths, (dir) => {
Collapse file

‎test/parallel/test-eslint-avoid-prototype-pollution.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-eslint-avoid-prototype-pollution.js
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -295,5 +295,9 @@ new RuleTester({
295295
code: 'PromiseRace([])',
296296
errors: [{ message: /\bSafePromiseRace\b/ }]
297297
},
298+
{
299+
code: 'ArrayPrototypeConcat([])',
300+
errors: [{ message: /\bisConcatSpreadable\b/ }]
301+
},
298302
]
299303
});
Collapse file

‎tools/eslint-rules/avoid-prototype-pollution.js‎

Copy file name to clipboardExpand all lines: tools/eslint-rules/avoid-prototype-pollution.js
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,14 @@ module.exports = {
224224
message: `Use Safe${node.callee.name} instead of ${node.callee.name}`,
225225
});
226226
},
227+
228+
[CallExpression('ArrayPrototypeConcat')](node) {
229+
context.report({
230+
node,
231+
message: '%Array.prototype.concat% looks up `@@isConcatSpreadable` ' +
232+
'which can be subject to prototype pollution',
233+
});
234+
},
227235
};
228236
},
229237
};

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.