Skip to content

Commit 1e32520

Browse files
aduh95juanarbol
authored andcommitted
tools: add ArrayPrototypeConcat to the list of primordials to avoid
PR-URL: #44445 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Joyee Cheung <[email protected]> Reviewed-By: Rafael Gonzaga <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
1 parent 55e4140 commit 1e32520

File tree

10 files changed

+52
-29
lines changed

10 files changed

+52
-29
lines changed

lib/internal/bootstrap/node.js

+6-6
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ setupPrepareStackTrace();
5656

5757
const {
5858
Array,
59-
ArrayPrototypeConcat,
6059
ArrayPrototypeFill,
60+
ArrayPrototypePushApply,
6161
FunctionPrototypeCall,
6262
JSONParse,
6363
ObjectDefineProperty,
@@ -195,11 +195,11 @@ const rawMethods = internalBinding('process_methods');
195195

196196
process.getActiveResourcesInfo = function() {
197197
const timerCounts = internalTimers.getTimerCounts();
198-
return ArrayPrototypeConcat(
199-
rawMethods._getActiveRequestsInfo(),
200-
rawMethods._getActiveHandlesInfo(),
201-
ArrayPrototypeFill(new Array(timerCounts.timeoutCount), 'Timeout'),
202-
ArrayPrototypeFill(new Array(timerCounts.immediateCount), 'Immediate'));
198+
const info = rawMethods._getActiveRequestsInfo();
199+
ArrayPrototypePushApply(info, rawMethods._getActiveHandlesInfo());
200+
ArrayPrototypePushApply(info, ArrayPrototypeFill(new Array(timerCounts.timeoutCount), 'Timeout'));
201+
ArrayPrototypePushApply(info, ArrayPrototypeFill(new Array(timerCounts.immediateCount), 'Immediate'));
202+
return info;
203203
};
204204

205205
// TODO(joyeecheung): remove these

lib/internal/debugger/inspect.js

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
'use strict';
22

33
const {
4-
ArrayPrototypeConcat,
54
ArrayPrototypeForEach,
65
ArrayPrototypeJoin,
76
ArrayPrototypeMap,
87
ArrayPrototypePop,
8+
ArrayPrototypePushApply,
99
ArrayPrototypeShift,
1010
ArrayPrototypeSlice,
1111
FunctionPrototypeBind,
@@ -79,9 +79,8 @@ const debugRegex = /Debugger listening on ws:\/\/\[?(.+?)\]?:(\d+)\//;
7979
async function runScript(script, scriptArgs, inspectHost, inspectPort,
8080
childPrint) {
8181
await portIsFree(inspectHost, inspectPort);
82-
const args = ArrayPrototypeConcat(
83-
[`--inspect-brk=${inspectPort}`, script],
84-
scriptArgs);
82+
const args = [`--inspect-brk=${inspectPort}`, script];
83+
ArrayPrototypePushApply(args, scriptArgs);
8584
const child = spawn(process.execPath, args);
8685
child.stdout.setEncoding('utf8');
8786
child.stderr.setEncoding('utf8');

lib/internal/main/print_help.js

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ for (const key of ObjectKeys(types))
3131
// Environment variables are parsed ad-hoc throughout the code base,
3232
// so we gather the documentation here.
3333
const { hasIntl, hasSmallICU, hasNodeOptions } = internalBinding('config');
34+
// eslint-disable-next-line node-core/avoid-prototype-pollution
3435
const envVars = new SafeMap(ArrayPrototypeConcat([
3536
['FORCE_COLOR', { helpText: "when set to 'true', 1, 2, 3, or an empty " +
3637
'string causes NO_COLOR and NODE_DISABLE_COLORS to be ignored.' }],

lib/internal/modules/cjs/loader.js

+12-4
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323

2424
const {
2525
ArrayIsArray,
26-
ArrayPrototypeConcat,
2726
ArrayPrototypeFilter,
2827
ArrayPrototypeIncludes,
2928
ArrayPrototypeIndexOf,
@@ -655,7 +654,13 @@ Module._findPath = function(request, paths, isMain) {
655654
Module._pathCache[cacheKey] = filename;
656655
return filename;
657656
}
658-
reportModuleNotFoundToWatchMode(basePath, ArrayPrototypeConcat([''], exts));
657+
658+
if (exts === undefined) {
659+
exts = [''];
660+
} else {
661+
ArrayPrototypeUnshift(exts, '');
662+
}
663+
reportModuleNotFoundToWatchMode(basePath, exts);
659664
}
660665

661666
return false;
@@ -769,9 +774,12 @@ Module._resolveLookupPaths = function(request, parent) {
769774
StringPrototypeCharAt(request, 1) !== '/' &&
770775
(!isWindows || StringPrototypeCharAt(request, 1) !== '\\'))) {
771776

772-
let paths = modulePaths;
777+
let paths;
773778
if (parent?.paths?.length) {
774-
paths = ArrayPrototypeConcat(parent.paths, paths);
779+
paths = ArrayPrototypeSlice(modulePaths);
780+
ArrayPrototypeUnshiftApply(paths, parent.paths);
781+
} else {
782+
paths = modulePaths;
775783
}
776784

777785
debug('looking for %j in %j', request, paths);

lib/internal/modules/esm/resolve.js

+6-6
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
const {
44
ArrayIsArray,
5-
ArrayPrototypeConcat,
65
ArrayPrototypeJoin,
6+
ArrayPrototypePush,
77
ArrayPrototypeShift,
88
JSONParse,
99
JSONStringify,
@@ -1052,11 +1052,11 @@ function throwIfUnsupportedURLScheme(parsed, experimentalNetworkImports) {
10521052
)
10531053
)
10541054
) {
1055-
throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, ArrayPrototypeConcat(
1056-
'file',
1057-
'data',
1058-
experimentalNetworkImports ? ['https', 'http'] : [],
1059-
));
1055+
const schemes = ['file', 'data'];
1056+
if (experimentalNetworkImports) {
1057+
ArrayPrototypePush(schemes, 'https', 'http');
1058+
}
1059+
throw new ERR_UNSUPPORTED_ESM_URL_SCHEME(parsed, schemes);
10601060
}
10611061
}
10621062

lib/internal/perf/observe.js

+4-2
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ const {
99
ArrayPrototypePushApply,
1010
ArrayPrototypeSlice,
1111
ArrayPrototypeSort,
12-
ArrayPrototypeConcat,
1312
Error,
1413
MathMax,
1514
MathMin,
@@ -470,7 +469,10 @@ function filterBufferMapByNameAndType(name, type) {
470469
// Unrecognized type;
471470
return [];
472471
} else {
473-
bufferList = ArrayPrototypeConcat(markEntryBuffer, measureEntryBuffer, resourceTimingBuffer);
472+
bufferList = [];
473+
ArrayPrototypePushApply(bufferList, markEntryBuffer);
474+
ArrayPrototypePushApply(bufferList, measureEntryBuffer);
475+
ArrayPrototypePushApply(bufferList, resourceTimingBuffer);
474476
}
475477
if (name !== undefined) {
476478
bufferList = ArrayPrototypeFilter(bufferList, (buffer) => buffer.name === name);

lib/internal/util/inspector.js

+4-5
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
'use strict';
22

33
const {
4-
ArrayPrototypeConcat,
54
ArrayPrototypeSome,
5+
ArrayPrototypePushApply,
66
FunctionPrototypeBind,
77
ObjectDefineProperty,
88
ObjectKeys,
@@ -69,10 +69,9 @@ function installConsoleExtensions(commandLineApi) {
6969
const { makeRequireFunction } = require('internal/modules/cjs/helpers');
7070
const consoleAPIModule = new CJSModule('<inspector console>');
7171
const cwd = tryGetCwd();
72-
consoleAPIModule.paths = ArrayPrototypeConcat(
73-
CJSModule._nodeModulePaths(cwd),
74-
CJSModule.globalPaths
75-
);
72+
consoleAPIModule.paths = [];
73+
ArrayPrototypePushApply(consoleAPIModule.paths, CJSModule._nodeModulePaths(cwd));
74+
ArrayPrototypePushApply(consoleAPIModule.paths, CJSModule.globalPaths);
7675
commandLineApi.require = makeRequireFunction(consoleAPIModule);
7776
}
7877

lib/repl.js

+4-2
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,6 @@
4343
'use strict';
4444

4545
const {
46-
ArrayPrototypeConcat,
4746
ArrayPrototypeFilter,
4847
ArrayPrototypeFindIndex,
4948
ArrayPrototypeForEach,
@@ -52,6 +51,7 @@ const {
5251
ArrayPrototypeMap,
5352
ArrayPrototypePop,
5453
ArrayPrototypePush,
54+
ArrayPrototypePushApply,
5555
ArrayPrototypeReverse,
5656
ArrayPrototypeShift,
5757
ArrayPrototypeSlice,
@@ -1333,7 +1333,9 @@ function complete(line, callback) {
13331333
} else if (RegExpPrototypeExec(/^\.\.?\//, completeOn) !== null) {
13341334
paths = [process.cwd()];
13351335
} else {
1336-
paths = ArrayPrototypeConcat(module.paths, CJSModule.globalPaths);
1336+
paths = [];
1337+
ArrayPrototypePushApply(paths, module.paths);
1338+
ArrayPrototypePushApply(paths, CJSModule.globalPaths);
13371339
}
13381340

13391341
ArrayPrototypeForEach(paths, (dir) => {

test/parallel/test-eslint-avoid-prototype-pollution.js

+4
Original file line numberDiff line numberDiff line change
@@ -256,5 +256,9 @@ new RuleTester({
256256
code: 'PromiseRace([])',
257257
errors: [{ message: /\bSafePromiseRace\b/ }]
258258
},
259+
{
260+
code: 'ArrayPrototypeConcat([])',
261+
errors: [{ message: /\bisConcatSpreadable\b/ }]
262+
},
259263
]
260264
});

tools/eslint-rules/avoid-prototype-pollution.js

+8
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,14 @@ module.exports = {
200200
message: `Use Safe${node.callee.name} instead of ${node.callee.name}`,
201201
});
202202
},
203+
204+
[CallExpression('ArrayPrototypeConcat')](node) {
205+
context.report({
206+
node,
207+
message: '%Array.prototype.concat% looks up `@@isConcatSpreadable` ' +
208+
'which can be subject to prototype pollution',
209+
});
210+
},
203211
};
204212
},
205213
};

0 commit comments

Comments
 (0)