1'use strict'; 2const common = require('../common'); 3const assert = require('assert'); 4const fs = require('fs').promises; 5const { MessageChannel } = require('worker_threads'); 6const { once } = require('events'); 7 8// Test that overriding the internal kTransfer method of a JSTransferable does 9// not enable loading arbitrary code from internal Node.js core modules. 10 11(async function() { 12 const fh = await fs.open(__filename); 13 assert.strictEqual(fh.constructor.name, 'FileHandle'); 14 15 const kTransfer = Object.getOwnPropertySymbols(Object.getPrototypeOf(fh)) 16 .filter((symbol) => symbol.description === 'messaging_transfer_symbol')[0]; 17 assert.strictEqual(typeof kTransfer, 'symbol'); 18 fh[kTransfer] = () => { 19 return { 20 data: '✨', 21 deserializeInfo: 'net:Socket' 22 }; 23 }; 24 25 const { port1, port2 } = new MessageChannel(); 26 port1.postMessage(fh, [ fh ]); 27 port2.on('message', common.mustNotCall()); 28 29 const [ exception ] = await once(port2, 'messageerror'); 30 31 assert.strictEqual(exception.message, 'Unknown deserialize spec net:Socket'); 32 port2.close(); 33})().then(common.mustCall()); 34