lib: use null-prototype objects for property descriptors

Refs: https://github.com/nodejs/node/pull/42921

PR-URL: https://github.com/nodejs/node/pull/43270
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/lib/repl.js b/lib/repl.js
index af9b607b02..7c17272f6e 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -285,6 +285,7 @@ function REPLServer(prompt,
     (options.preview !== undefined ? !!options.preview : !eval_);
 
   ObjectDefineProperty(this, 'inputStream', {
+    __proto__: null,
     get: pendingDeprecation ?
       deprecate(() => this.input,
                 'repl.inputStream and repl.outputStream are deprecated. ' +
@@ -301,6 +302,7 @@ function REPLServer(prompt,
     configurable: true
   });
   ObjectDefineProperty(this, 'outputStream', {
+    __proto__: null,
     get: pendingDeprecation ?
       deprecate(() => this.output,
                 'repl.inputStream and repl.outputStream are deprecated. ' +
@@ -783,6 +785,7 @@ function REPLServer(prompt,
 
     if (options[kStandaloneREPL]) {
       ObjectDefineProperty(inspect, 'replDefaults', {
+        __proto__: null,
         get() {
           return writer.options;
         },
@@ -1083,12 +1086,16 @@ REPLServer.prototype.createContext = function() {
       // Only set properties that do not already exist as a global builtin.
       if (!globalBuiltins.has(name)) {
         ObjectDefineProperty(context, name,
-                             ObjectGetOwnPropertyDescriptor(globalThis, name));
+                             {
+                               __proto__: null,
+                               ...ObjectGetOwnPropertyDescriptor(globalThis, name),
+                             });
       }
     });
     context.global = context;
     const _console = new Console(this.output);
     ObjectDefineProperty(context, 'console', {
+      __proto__: null,
       configurable: true,
       writable: true,
       value: _console
@@ -1099,11 +1106,13 @@ REPLServer.prototype.createContext = function() {
   replModule.paths = CJSModule._resolveLookupPaths('<repl>', parentModule);
 
   ObjectDefineProperty(context, 'module', {
+    __proto__: null,
     configurable: true,
     writable: true,
     value: replModule
   });
   ObjectDefineProperty(context, 'require', {
+    __proto__: null,
     configurable: true,
     writable: true,
     value: makeRequireFunction(replModule)
@@ -1123,6 +1132,7 @@ REPLServer.prototype.resetContext = function() {
   this.lines.level = [];
 
   ObjectDefineProperty(this.context, '_', {
+    __proto__: null,
     configurable: true,
     get: () => this.last,
     set: (value) => {
@@ -1135,6 +1145,7 @@ REPLServer.prototype.resetContext = function() {
   });
 
   ObjectDefineProperty(this.context, '_error', {
+    __proto__: null,
     configurable: true,
     get: () => this.lastError,
     set: (value) => {
@@ -1805,6 +1816,7 @@ module.exports = {
 };
 
 ObjectDefineProperty(module.exports, 'builtinModules', {
+  __proto__: null,
   get: () => _builtinLibs,
   set: (val) => _builtinLibs = val,
   enumerable: true,
@@ -1812,6 +1824,7 @@ ObjectDefineProperty(module.exports, 'builtinModules', {
 });
 
 ObjectDefineProperty(module.exports, '_builtinLibs', {
+  __proto__: null,
   get: pendingDeprecation ? deprecate(
     () => _builtinLibs,
     'repl._builtinLibs is deprecated. Check module.builtinModules instead',