• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1'use strict';
2const common = require('../common');
3const assert = require('assert');
4const fs = require('fs').promises;
5const { MessageChannel } = require('worker_threads');
6const { once } = require('events');
7
8// Test that overriding the internal kTransfer method of a JSTransferable does
9// not enable loading arbitrary code from the disk.
10
11module.exports = {
12  NotARealClass: common.mustNotCall()
13};
14
15(async function() {
16  const fh = await fs.open(__filename);
17  assert.strictEqual(fh.constructor.name, 'FileHandle');
18
19  const kTransfer = Object.getOwnPropertySymbols(Object.getPrototypeOf(fh))
20    .filter((symbol) => symbol.description === 'messaging_transfer_symbol')[0];
21  assert.strictEqual(typeof kTransfer, 'symbol');
22  fh[kTransfer] = () => {
23    return {
24      data: '✨',
25      deserializeInfo: `${__filename}:NotARealClass`
26    };
27  };
28
29  const { port1, port2 } = new MessageChannel();
30  port1.postMessage(fh, [ fh ]);
31  port2.on('message', common.mustNotCall());
32
33  const [ exception ] = await once(port2, 'messageerror');
34
35  assert.match(exception.message, /Missing internal module/);
36  port2.close();
37})().then(common.mustCall());
38