-
-
Notifications
You must be signed in to change notification settings - Fork 31.7k
The document is different from the runtime #48688
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
The "with const assert = require('assert');
const http = require('http');
function Options() {}
Options.prototype.method = 'POST';
const options = new Options();
assert.strictEqual(options.method, 'POST');
const server = http.createServer();
server.on('request', function (request, response) {
console.log(request.method);
response.end('OK');
});
server.listen(function () {
const { port } = server.address();
const request = http.get(`http://localhost:${port}`, options);
request.on('response', function (response) {
response.resume();
response.on('end', function () {
server.close();
});
});
}); |
The last sentence inherits attributes from the prototype to ignore ambiguities, which I understand as follows: const http = require('http');
var obj = {};
obj.__proto__.method = 'POST';
const server = http.createServer();
server.on('request', function (request, response) {
console.log(request.method);
response.end('OK');
});
server.listen(function () {
const { port } = server.address();
const request = http.get(`http://localhost:${port}`);
request.on('response', function (response) {
response.resume();
response.on('end', function () {
server.close();
});
});
}); If the code written by the user has any prototype chain contamination, there may be a vulnerability hazard |
Wanna open a docs PR? A fix would probably be: "With the method set to |
Yes, I did, I originally wanted to fix this prototype inheritance issue because it could cause bugs, but I found I couldn't do it, so I fixed docs |
Changing the global object prototype is a different thing and is at the user's risk. It is not limited to this but the whole runtime environment. |
PR-URL: #48692 Fixes: #48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: nodejs#48692 Fixes: nodejs#48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: nodejs#48692 Fixes: nodejs#48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: #48692 Fixes: #48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: #48692 Fixes: #48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
PR-URL: #48692 Fixes: #48688 Reviewed-By: Robert Nagy <[email protected]> Reviewed-By: Marco Ippolito <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Matteo Collina <[email protected]>
Version
all
Platform
all
Subsystem
No response
What steps will reproduce the bug?
that's what it says in the documentation


but i test it
How often does it reproduce? Is there a required condition?
all
What is the expected behavior? Why is that the expected behavior?
It does not inherit the properties of the prototype
What do you see instead?
It inherits the properties of the prototype
Additional information
No response
The text was updated successfully, but these errors were encountered: