-
Notifications
You must be signed in to change notification settings - Fork 30.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
The document is different from the runtime #48688
Comments
The "with const assert = require('assert');
const http = require('http');
function Options() {}
Options.prototype.method = 'POST';
const options = new Options();
assert.strictEqual(options.method, 'POST');
const server = http.createServer();
server.on('request', function (request, response) {
console.log(request.method);
response.end('OK');
});
server.listen(function () {
const { port } = server.address();
const request = http.get(`http://localhost:${port}`, options);
request.on('response', function (response) {
response.resume();
response.on('end', function () {
server.close();
});
});
}); |
The last sentence inherits attributes from the prototype to ignore ambiguities, which I understand as follows: const http = require('http');
var obj = {};
obj.__proto__.method = 'POST';
const server = http.createServer();
server.on('request', function (request, response) {
console.log(request.method);
response.end('OK');
});
server.listen(function () {
const { port } = server.address();
const request = http.get(`http://localhost:${port}`);
request.on('response', function (response) {
response.resume();
response.on('end', function () {
server.close();
});
});
}); If the code written by the user has any prototype chain contamination, there may be a vulnerability hazard |
Wanna open a docs PR? A fix would probably be: "With the method set to |
Yes, I did, I originally wanted to fix this prototype inheritance issue because it could cause bugs, but I found I couldn't do it, so I fixed docs |
Changing the global object prototype is a different thing and is at the user's risk. It is not limited to this but the whole runtime environment. |
PR-URL: nodejs#48692 Fixes: nodejs#48688 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
PR-URL: nodejs#48692 Fixes: nodejs#48688 Reviewed-By: Robert Nagy <ronagy@icloud.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Version
all
Platform
all
Subsystem
No response
What steps will reproduce the bug?
that's what it says in the documentation
but i test it
How often does it reproduce? Is there a required condition?
all
What is the expected behavior? Why is that the expected behavior?
It does not inherit the properties of the prototype
What do you see instead?
It inherits the properties of the prototype
Additional information
No response
The text was updated successfully, but these errors were encountered: