test(worker): cover __proto__ key in entry-options-merge pollution guard

alexander-akait · alexander-akait · commit 36aadab2ca9e · 2026-05-25T13:58:48.000Z
Add a computed `["__proto__"]` key to the second worker's
webpackEntryOptions and assert the entrypoint options carry no
`__proto__` own key and that their prototype is untouched, so the
WorkerPlugin denylist is exercised for all three special keys.
diff --git a/test/configCases/worker/entry-options-merge/index.js b/test/configCases/worker/entry-options-merge/index.js
@@ -6,7 +6,7 @@ it("should merge entryOptions when two async blocks share an entrypoint name", a
 		new URL("./worker.js", import.meta.url)
 	);
 	const w2 = new Worker(
-		/* webpackEntryOptions: { name: "merged", runtime: "merged-rt", asyncChunks: false, prototype: { polluted: true }, constructor: { polluted: true } } */
+		/* webpackEntryOptions: { name: "merged", runtime: "merged-rt", asyncChunks: false, prototype: { polluted: true }, constructor: { polluted: true }, ["__proto__"]: { polluted: true } } */
 		new URL("./worker.js", import.meta.url)
 	);
 	expect({}.polluted).toBeUndefined();
diff --git a/test/configCases/worker/entry-options-merge/webpack.config.js b/test/configCases/worker/entry-options-merge/webpack.config.js
@@ -40,13 +40,18 @@ class AssertMergedEntryOptionsPlugin {
 						}
 						// Prototype-polluting keys from the magic comment must not be
 						// gap-filled onto the entrypoint options.
-						for (const unsafe of ["prototype", "constructor"]) {
+						for (const unsafe of ["prototype", "constructor", "__proto__"]) {
 							if (Object.prototype.hasOwnProperty.call(options, unsafe)) {
 								compilation.errors.push(
 									new Error(`entrypoint options must not carry "${unsafe}"`)
 								);
 							}
 						}
+						if (Object.getPrototypeOf(options) !== Object.prototype) {
+							compilation.errors.push(
+								new Error("entrypoint options prototype must be untouched")
+							);
+						}
 					}
 				);
 			}

Original file line number	Diff line number	Diff line change
`@@ -40,13 +40,18 @@ class AssertMergedEntryOptionsPlugin {`
`40`	`40`	`}`
`41`	`41`	`// Prototype-polluting keys from the magic comment must not be`
`42`	`42`	`// gap-filled onto the entrypoint options.`
`43`		`- for (const unsafe of ["prototype", "constructor"]) {`
	`43`	`+ for (const unsafe of ["prototype", "constructor", "__proto__"]) {`
`44`	`44`	`if (Object.prototype.hasOwnProperty.call(options, unsafe)) {`
`45`	`45`	`compilation.errors.push(`
`46`	`46`	new Error(`entrypoint options must not carry "${unsafe}"`)
`47`	`47`	`);`
`48`	`48`	`}`
`49`	`49`	`}`
	`50`	`+ if (Object.getPrototypeOf(options) !== Object.prototype) {`
	`51`	`+ compilation.errors.push(`
	`52`	`+ new Error("entrypoint options prototype must be untouched")`
	`53`	`+ );`
	`54`	`+ }`
`50`	`55`	`}`
`51`	`56`	`);`
`52`	`57`	`}`