cloudflare / cloudflare/workerd
Investigate effect of injecting `Object.prototype.then` on fetch
- Dominant language
- C++
- Stars
- 8.7k
- Forks
- 739
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 174
Description
See [`fetch/api/response/response-stream-with-broken-then.any.js`](https://github.com/web-platform-tests/wpt/blob/7fdc8568cb9e3d3eed870ea1468944dc3d4228d9/fetch/api/response/response-stream-with-broken-then.any.js#L4):
- Attempt to inject {done: false, value: bye} via Object.prototype.then.
- Attempt to inject value: undefined via Object.prototype.then.
- Attempt to inject undefined via Object.prototype.then.
- Attempt to inject 8.2 via Object.prototype.then.
- intercepting arraybuffer to text conversion via Object.prototype.then should not be possible'
- intercepting arraybuffer to body readable stream conversion via Object.prototype.then should not be possible
In all these cases, WPT is expecting us to:
- ✅ Resist the attempt at prototype pollution
- ❌ Not throw an error
- We throw this clunky internal error: `promise.h:103: failed: expected Wrappable::tryUnwrapOpaque(isolate, handle) != nullptr'`
We need to decide what to do:
- Do as WPT wants and silently ignore it
- Present a more user-friendly message explaining why we refuse to work with this?
Contributor guide
Assessment
This issue has not been assessed yet.