lib: use __proto__: null when calling ObjectDefineProperty

aduh95 · aduh95 · commit e62b075ea84b · 2026-07-21T15:24:48.000+02:00
Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #64239 Reviewed-By: Jordan Harband <ljharb@gmail.com> Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>
diff --git a/lib/internal/debugger/inspect_repl.js b/lib/internal/debugger/inspect_repl.js
@@ -19,15 +19,17 @@ const {
   JSONStringify,
   MathMax,
   ObjectAssign,
+  ObjectDefineProperties,
   ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptors,
   ObjectKeys,
+  ObjectSetPrototypeOf,
   ObjectValues,
   Promise,
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
   ReflectGetOwnPropertyDescriptor,
-  ReflectOwnKeys,
   RegExpPrototypeExec,
   SafeMap,
   SafePromiseAllReturnArrayLike,
@@ -347,18 +349,20 @@ class ScopeSnapshot {
 }
 
 function copyOwnProperties(target, source) {
-  ArrayPrototypeForEach(
-    ReflectOwnKeys(source),
-    (prop) => {
-      const desc = ReflectGetOwnPropertyDescriptor(source, prop);
-      ObjectDefineProperty(target, prop, desc);
-    });
+  const descriptors = ObjectGetOwnPropertyDescriptors(source);
+
+  const descValues = ObjectValues(descriptors);
+  for (let i = 0; i < descValues.length; ++i) {
+    ObjectSetPrototypeOf(descValues[i], null);
+  }
+
+  ObjectDefineProperties(target, descriptors);
 }
 
 function aliasProperties(target, mapping) {
   ArrayPrototypeForEach(ObjectKeys(mapping), (key) => {
     const desc = ReflectGetOwnPropertyDescriptor(target, key);
-    ObjectDefineProperty(target, mapping[key], desc);
+    ObjectDefineProperty(target, mapping[key], { __proto__: null, ...desc });
   });
 }
 
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
@@ -3246,6 +3246,7 @@ function handleHeaderContinue(headers) {
 }
 
 const setTimeoutValue = {
+  __proto__: null,
   configurable: true,
   enumerable: true,
   writable: true,
diff --git a/lib/internal/per_context/domexception.js b/lib/internal/per_context/domexception.js
@@ -196,7 +196,7 @@ for (const { 0: name, 1: codeName, 2: value } of [
   // There are some more error names, but since they don't have codes assigned,
   // we don't need to care about them.
 ]) {
-  const desc = { enumerable: true, value };
+  const desc = { __proto__: null, enumerable: true, value };
   ObjectDefineProperty(DOMException, codeName, desc);
   ObjectDefineProperty(DOMExceptionPrototype, codeName, desc);
   nameToCodeMap.set(name, value);
diff --git a/lib/internal/test_runner/mock/mock.js b/lib/internal/test_runner/mock/mock.js
@@ -7,10 +7,14 @@ const {
   FunctionPrototypeBind,
   FunctionPrototypeCall,
   ObjectAssign,
+  ObjectDefineProperties,
   ObjectDefineProperty,
   ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyDescriptors,
   ObjectGetPrototypeOf,
   ObjectKeys,
+  ObjectSetPrototypeOf,
+  ObjectValues,
   Proxy,
   ReflectApply,
   ReflectConstruct,
@@ -146,7 +150,7 @@ class MockFunctionContext {
 
     if (typeof methodName === 'string') {
       // This is an object method spy.
-      ObjectDefineProperty(object, methodName, descriptor);
+      ObjectDefineProperty(object, methodName, { __proto__: null, ...descriptor });
     } else {
       // This is a bare function spy. There isn't much to do here but make
       // the mock call the original function.
@@ -880,13 +884,14 @@ function normalizeModuleMockOptions(options) {
 
 
 function copyOwnProperties(from, to) {
-  const keys = ObjectKeys(from);
+  const descriptors = ObjectGetOwnPropertyDescriptors(from);
 
-  for (let i = 0; i < keys.length; ++i) {
-    const key = keys[i];
-    const descriptor = ObjectGetOwnPropertyDescriptor(from, key);
-    ObjectDefineProperty(to, key, descriptor);
+  const descValues = ObjectValues(descriptors);
+  for (let i = 0; i < descValues.length; ++i) {
+    ObjectSetPrototypeOf(descValues[i], null);
   }
+
+  ObjectDefineProperties(to, descriptors);
 }
 
 function setupSharedModuleState() {
diff --git a/lib/internal/test_runner/mock/mock_timers.js b/lib/internal/test_runner/mock/mock_timers.js
@@ -13,6 +13,7 @@ const {
   ObjectDefineProperty,
   ObjectGetOwnPropertyDescriptor,
   ObjectGetOwnPropertyDescriptors,
+  ObjectSetPrototypeOf,
   PromiseWithResolvers,
   Symbol,
   SymbolDispose,
@@ -325,7 +326,7 @@ class MockTimers {
   }
 
   #restoreOriginalAbortSignalTimeout() {
-    ObjectDefineProperty(AbortSignal, 'timeout', this.#realAbortSignalTimeout);
+    ObjectDefineProperty(AbortSignal, 'timeout', ObjectSetPrototypeOf(this.#realAbortSignalTimeout, null));
   }
 
   #createTimer(isInterval, callback, delay, ...args) {
@@ -633,7 +634,7 @@ class MockTimers {
           );
         },
         'Date': () => {
-          this.#nativeDateDescriptor = ObjectGetOwnPropertyDescriptor(globalThis, 'Date');
+          this.#nativeDateDescriptor = ObjectSetPrototypeOf(ObjectGetOwnPropertyDescriptor(globalThis, 'Date'), null);
           globalThis.Date = this.#createDate();
         },
         'AbortSignal.timeout': () => {

Original file line number	Diff line number	Diff line change
`@@ -3246,6 +3246,7 @@ function handleHeaderContinue(headers) {`
`3246`	`3246`	`}`
`3247`	`3247`
`3248`	`3248`	`const setTimeoutValue = {`
	`3249`	`+ __proto__: null,`
`3249`	`3250`	`configurable: true,`
`3250`	`3251`	`enumerable: true,`
`3251`	`3252`	`writable: true,`