Describe the bug
On Hermes we never reach (in whitelistIntrinsics)
|
if (typeof obj === 'function' && prop === 'prototype') { |
|
obj.prototype = undefined; |
but reach here first instead
|
const completePrototypes = () => { |
|
for (const [name, intrinsic] of entries(intrinsics)) { |
|
if (!isObject(intrinsic)) { |
|
// eslint-disable-next-line no-continue |
|
continue; |
|
} |
|
if (!objectHasOwnProperty(intrinsic, 'prototype')) { |
|
// eslint-disable-next-line no-continue |
|
continue; |
|
} |
|
const permit = permitted[name]; |
|
if (typeof permit !== 'object') { |
|
throw TypeError(`Expected permit object at whitelist.${name}`); |
|
} |
|
const namePrototype = permit.prototype; |
|
if (!namePrototype) { |
|
throw TypeError(`${name}.prototype property not whitelisted`); |
order of events and conditions
- intrinsics.js > completePrototypes
isObject(intrinsic)objectHasOwnProperty(intrinsic, 'prototype')typeof permit === 'object'!permit.prototype
throw TypeError(`${name}.prototype property not whitelisted`);
- permit-intrinsics.js > whitelistIntrinsics
prop in objtypeof obj === 'function' && prop === 'prototype'
Steps to reproduce
Expected behavior
The prototype to be set to undefined earlier
so we continue which skips throwing the TypeError
Platform environment
- macOS Sequoia 15.0.1
- Node v20.12.2
- Hermes v0.12.0 (lockdown), v0.13.0 (harden)
- @endo/base64@1.0.8-10-gb3a31b155
Additional context
Note: on Static Hermes this is a non-issue, since both prototype bugs are fixed
Screenshots
Describe the bug
On Hermes we never reach (in whitelistIntrinsics)
endo/packages/ses/src/permits-intrinsics.js
Lines 303 to 304 in b3a31b1
but reach here first instead
endo/packages/ses/src/intrinsics.js
Lines 87 to 103 in b3a31b1
order of events and conditions
isObject(intrinsic)objectHasOwnProperty(intrinsic, 'prototype')typeof permit === 'object'!permit.prototypethrow TypeError(`${name}.prototype property not whitelisted`);prop in objtypeof obj === 'function' && prop === 'prototype'obj.prototype = undefined(not reached)Steps to reproduce
yarn build:hermes && yarn test:hermesExpected behavior
The prototype to be set to
undefinedearlierso we
continuewhich skips throwing the TypeErrorPlatform environment
Additional context
Note: on Static Hermes this is a non-issue, since both prototype bugs are fixed
Screenshots