Antoine du Hamel 2e2dc99115 esm: protect ESM loader from prototype pollution ...

In a previous commit, the loader implementation was modified to be
protected against most prototype pollution, but was kept vulnerable to
`Array.prototype` pollution. This commit fixes that, the tradeoff is
that it modifies the `ESMLoader.prototype.import` return type from an
`Array` to an array-like object.

Refs: https://github.com/nodejs/node/pull/45044
PR-URL: https://github.com/nodejs/node/pull/45175
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

2022-10-27 20:09:07 +00:00

..

assert

…

dns

dns: make promise API fully constructed from lib/internal/dns/promises

2022-06-20 19:58:45 +01:00

fs

…

inspector

inspector: refactor inspector/promises to be more robust

2022-10-19 18:39:31 +00:00

internal

esm: protect ESM loader from prototype pollution

2022-10-27 20:09:07 +00:00

path

…

readline

readline: remove question method from InterfaceConstructor

2022-09-14 19:10:53 +00:00

stream

stream: add reduce

2022-01-30 14:07:32 +00:00

timers

timers: use kEmptyObject

2022-06-11 12:18:15 +02:00

util

…

_http_agent.js

http: use Keep-Alive by default in global agents

2022-06-29 12:48:52 +02:00

_http_client.js

http: trace http request / response

2022-08-05 14:25:06 +00:00

_http_common.js

http: fix http server connection list when close

2022-07-24 15:06:24 +01:00

_http_incoming.js

lib: use null-prototype objects for property descriptors

2022-06-03 09:23:58 +01:00

_http_outgoing.js

http: throw error on content-length mismatch

2022-09-18 12:39:37 +02:00

_http_server.js

Revert "http: do not leak error listeners"

2022-10-12 12:16:56 +00:00

_stream_duplex.js

…

_stream_passthrough.js

…

_stream_readable.js

…

_stream_transform.js

…

_stream_wrap.js

…

_stream_writable.js

…

_tls_common.js

tools: report unsafe string and regex primordials as lint errors

2022-06-16 00:21:57 +02:00

_tls_wrap.js

src: optimize ALPN callback

2022-10-19 19:26:43 +00:00

.eslintrc.yaml

perf_hooks: expose webperf global scope interfaces

2022-10-04 00:56:05 +08:00

assert.js

assert: add assert.Snapshot

2022-08-11 13:07:52 +00:00

async_hooks.js

async_hooks: use kEmptyObject

2022-06-11 12:18:11 +02:00

buffer.js

buffer,lib: update atob to align wpt's base64.json

2022-10-09 13:20:42 +08:00

child_process.js

child_process: validate arguments for null bytes

2022-10-14 13:02:57 +00:00

cluster.js

…

console.js

…

constants.js

…

crypto.js

crypto: do not allow to call setFips from the worker thread

2022-07-08 11:50:24 +01:00

dgram.js

dgram: add dgram send queue info

2022-08-17 16:08:58 +00:00

diagnostics_channel.js

lib: improved diagnostics_channel subscribe/unsubscribe

2022-07-14 16:12:21 +00:00

dns.js

dns: remove unnecessary parameter from validateOneOf

2022-09-17 11:44:02 +00:00

domain.js

domain: fix vm promise tracking while keeping isolation

2022-07-14 12:05:50 +01:00

events.js

lib: performance improvement on readline async iterator

2022-10-24 12:49:16 +00:00

fs.js

fs: improve promise based readFile performance for big files

2022-10-06 17:03:56 +00:00

http2.js

…

http.js

http: make idle http parser count configurable

2022-07-29 10:00:38 +01:00

https.js

http: use Keep-Alive by default in global agents

2022-06-29 12:48:52 +02:00

inspector.js

inspector: expose inspector.close on workers

2022-09-13 09:04:24 +00:00

module.js

…

net.js

net: remove _readableState from debug statement

2022-10-21 06:37:05 +00:00

os.js

src: add error handling to uv_uptime call

2022-08-31 14:28:28 -05:00

path.js

path: the dot will be added(path.format) if it is not specified in ext

2022-10-10 15:12:08 +00:00

perf_hooks.js

perf_hooks: add resourcetiming buffer limit

2022-08-21 10:43:39 +08:00

process.js

src: disambiguate terms used to refer to builtins and addons

2022-08-09 01:36:49 +08:00

punycode.js

…

querystring.js

lib: include return types in JSDoc

2021-12-12 03:51:00 +00:00

readline.js

readline: remove question method from InterfaceConstructor

2022-09-14 19:10:53 +00:00

repl.js

esm: remove specifier resolution flag

2022-10-04 09:44:08 +00:00

stream.js

lib: use null-prototype objects for property descriptors

2022-06-03 09:23:58 +01:00

string_decoder.js

lib: use null-prototype objects for property descriptors

2022-06-03 09:23:58 +01:00

sys.js

…

test.js

test_runner: remove runtime experimental warning

2022-10-03 19:25:20 +00:00

timers.js

lib: use null-prototype objects for property descriptors

2022-06-03 09:23:58 +01:00

tls.js

lib: refactor to avoid unsafe regex primordials

2022-06-27 17:16:06 +02:00

trace_events.js

…

tty.js

tty: fix TypeError when stream is closed

2022-08-24 17:12:30 +00:00

url.js

url: remove \t \n \r in url.parse() similar to WHATWG

2022-10-24 21:24:46 +00:00

util.js

util: add MIME utilities (#21128)

2022-10-19 04:26:16 +02:00

v8.js

v8: add setHeapSnapshotNearHeapLimit

2022-09-08 09:33:20 +00:00

vm.js

src,lib: retrieve parsed source map url from v8

2022-10-23 22:37:21 +08:00

wasi.js

wasi: use WasmMemoryObject handle for perf (#43544)

2022-06-25 11:02:32 -07:00

worker_threads.js

…

zlib.js

lib: use null-prototype objects for property descriptors

2022-06-03 09:23:58 +01:00