1'use strict'; 2const common = require('../common'); 3const assert = require('assert'); 4const fs = require('fs').promises; 5const { MessageChannel } = require('worker_threads'); 6const { once } = require('events'); 7 8// Test that overriding the internal kTransfer method of a JSTransferable does 9// not enable loading arbitrary code from the disk. 10 11module.exports = { 12 NotARealClass: common.mustNotCall() 13}; 14 15(async function() { 16 const fh = await fs.open(__filename); 17 assert.strictEqual(fh.constructor.name, 'FileHandle'); 18 19 const kTransfer = Object.getOwnPropertySymbols(Object.getPrototypeOf(fh)) 20 .filter((symbol) => symbol.description === 'messaging_transfer_symbol')[0]; 21 assert.strictEqual(typeof kTransfer, 'symbol'); 22 fh[kTransfer] = () => { 23 return { 24 data: '✨', 25 deserializeInfo: `${__filename}:NotARealClass` 26 }; 27 }; 28 29 const { port1, port2 } = new MessageChannel(); 30 port1.postMessage(fh, [ fh ]); 31 port2.on('message', common.mustNotCall()); 32 33 const [ exception ] = await once(port2, 'messageerror'); 34 35 assert.match(exception.message, /Missing internal module/); 36 port2.close(); 37})().then(common.mustCall()); 38