cloudflare / cloudflare/workerd

Investigate effect of injecting `Object.prototype.then` on fetch

Open
#4,980 0 comments 0 reactions 2 assignees Claimed by @npaun View on GitHub
wpt-conformance
Dominant language
C++
Stars
8.7k
Forks
739
Avg merge
2d 20h
Merged PRs (30d)
174

Description

See [`fetch/api/response/response-stream-with-broken-then.any.js`](https://github.com/web-platform-tests/wpt/blob/7fdc8568cb9e3d3eed870ea1468944dc3d4228d9/fetch/api/response/response-stream-with-broken-then.any.js#L4):

- Attempt to inject {done: false, value: bye} via Object.prototype.then.
- Attempt to inject value: undefined via Object.prototype.then.
- Attempt to inject undefined via Object.prototype.then.
- Attempt to inject 8.2 via Object.prototype.then.
- intercepting arraybuffer to text conversion via Object.prototype.then should not be possible'
- intercepting arraybuffer to body readable stream conversion via Object.prototype.then should not be possible

In all these cases, WPT is expecting us to:

- ✅ Resist the attempt at prototype pollution
- ❌ Not throw an error
- We throw this clunky internal error: `promise.h:103: failed: expected Wrappable::tryUnwrapOpaque(isolate, handle) != nullptr'`

We need to decide what to do:
- Do as WPT wants and silently ignore it
- Present a more user-friendly message explaining why we refuse to work with this?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.