tools,doc: add guards against prototype pollution when creating proxies

[aduh95]

When defining a Proxy, the handler object could be at risk of prototype
pollution when using a plain object literal:

// User-landObject.prototype.get=()=>'Unrelated user-provided data';// CoreconstobjectToProxy={someProperty: 'genuine value'};constproxyWithPlainObjectLiteral=newProxy(objectToProxy,{has(){returnfalse;},});console.log(proxyWithPlainObjectLiteral.someProperty);// Unrelated user-provided dataconstproxyWithNullPrototypeObject=newProxy(objectToProxy,{__proto__: null,has(){returnfalse;},});console.log(proxyWithNullPrototypeObject.someProperty);// genuine value

[nodejs-github-bot]

Review requested:

• @nodejs/tsc

[LiviaMedeiros]

LGTM with a nit

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/44575/

[ChALkeR]

LGTM

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/44593/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/44599/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/43391 ✔ Done loading data for nodejs/node/pull/43391 ----------------------------------- PR info ------------------------------------ Title tools,doc: add guards against prototype pollution when creating proxies (#43391) ⚠ Could not retrieve the email or name of the PR author's from user's GitHub profile! Branch aduh95:proxy-prototype-pollution -> nodejs:main Labels tools, author ready, needs-ci, commit-queue-squash Commits 4 - tools,doc: add guards against prototype pollution when creating proxies - fixup! tools,doc: add guards against prototype pollution when creatin… - fixup! tools,doc: add guards against prototype pollution when creatin… - Update tools/eslint-rules/avoid-prototype-pollution.js Committers 2 - Antoine du Hamel - GitHub PR-URL: https://github.com/nodejs/node/pull/43391 Reviewed-By: James M Snell Reviewed-By: LiviaMedeiros Reviewed-By: Сковорода Никита Андреевич ------------------------------ Generated metadata ------------------------------ PR-URL: https://github.com/nodejs/node/pull/43391 Reviewed-By: James M Snell Reviewed-By: LiviaMedeiros Reviewed-By: Сковорода Никита Андреевич -------------------------------------------------------------------------------- ℹ This PR was created on Sun, 12 Jun 2022 11:53:36 GMT ✔ Approvals: 3 ✔ - James M Snell (@jasnell) (TSC): https://github.com/nodejs/node/pull/43391#pullrequestreview-1004583796 ✔ - LiviaMedeiros (@LiviaMedeiros): https://github.com/nodejs/node/pull/43391#pullrequestreview-1007161498 ✔ - Сковорода Никита Андреевич (@ChALkeR) (TSC): https://github.com/nodejs/node/pull/43391#pullrequestreview-1007417535 ✔ Last GitHub CI successful ℹ Last Full PR CI on 2022-06-15T20:46:03Z: https://ci.nodejs.org/job/node-test-pull-request/44599/ - Querying data for job/node-test-pull-request/44599/ ✔ Last Jenkins CI successful -------------------------------------------------------------------------------- ✔ No git cherry-pick in progress ✔ No git am in progress ✔ No git rebase in progress -------------------------------------------------------------------------------- - Bringing origin/main up to date... From https://github.com/nodejs/node * branch main -> FETCH_HEAD 70b516e4db..9119382555 main -> origin/main ✔ origin/main is now up-to-date main is out of sync with origin/main. Mismatched commits: - 9119382555 tools: report unsafe string and regex primordials as lint errors -------------------------------------------------------------------------------- HEAD is now at 9119382555 tools: report unsafe string and regex primordials as lint errors ✔ Reset to origin/main - Downloading patch for 43391 From https://github.com/nodejs/node * branch refs/pull/43391/merge -> FETCH_HEAD ✔ Fetched commits as 70b516e4dbdf..a92ce2efa40a -------------------------------------------------------------------------------- Auto-merging test/parallel/test-eslint-avoid-prototype-pollution.js CONFLICT (content): Merge conflict in test/parallel/test-eslint-avoid-prototype-pollution.js Auto-merging tools/eslint-rules/avoid-prototype-pollution.js CONFLICT (content): Merge conflict in tools/eslint-rules/avoid-prototype-pollution.js error: could not apply 86dc079e91... tools,doc: add guards against prototype pollution when creating proxies hint: After resolving the conflicts, mark them with hint: "git add/rm ", then run hint: "git cherry-pick --continue". hint: You can instead skip this commit with "git cherry-pick --skip". hint: To abort and get back to the state before "git cherry-pick", hint: run "git cherry-pick --abort". ✖ Failed to apply patches

https://github.com/nodejs/node/actions/runs/2505466684

[aduh95]

Landed in 358008f