Fix #8392: Ensure toString returns expected value on Object

brave · Nov 10, 2023 · edc6191 · edc6191
1 parent 235ce88
commit edc6191
Showing 1 changed file with 20 additions and 8 deletions.
diff --git a/Sources/Brave/Frontend/UserContent/UserScripts/__firefox__.js b/Sources/Brave/Frontend/UserContent/UserScripts/__firefox__.js
@@ -73,7 +73,11 @@ if (!window.__firefox__) {
     if ($Object.isExtensible(value)) {
       const description = (typeof value === 'function') ?
                           `function ${ typeof value.name !== 'undefined' ? value.name : "" }() {\n    [native code]\n}` :
-                          '[object Object]';
+                          'function toString() {\n    [native code]\n}';
+
+      const toStringString = function() {
+        return 'function toString() {\n    [native code]\n}';
+      };
 
       const toString = function() {
         return description;
@@ -103,25 +107,30 @@ if (!window.__firefox__) {
       }
 
       // Secure calls to `toString`
-      const secureToString = function(toString) {
-        for (const [name, property] of $Object.entries(overrides)) {
-          let descriptor = $Object.getOwnPropertyDescriptor(toString, name);
+      const secureToString = function(fn) {
+        var fnOverrides = {...overrides};
+        if ((fn === toString || fn === toStringString) && fnOverrides['toString']) {
+          fnOverrides['toString'] = toStringString;
+        }
+
+        for (const [name, property] of $Object.entries(fnOverrides)) {
+          let descriptor = $Object.getOwnPropertyDescriptor(fn, name);
           if (!descriptor || descriptor.configurable) {
-            $Object.defineProperty(toString, name, {
+            $Object.defineProperty(fn, name, {
               enumerable: false,
               configurable: false,
               writable: false,
               value: property
             });
           }
 
-          descriptor = $Object.getOwnPropertyDescriptor(toString, name);
+          descriptor = $Object.getOwnPropertyDescriptor(fn, name);
           if (!descriptor || descriptor.writable) {
-            toString[name] = property;
+            fn[name] = property;
           }
 
           if (name !== 'toString') {
-            $.deepFreeze(toString[name]);
+            $.deepFreeze(fn[name]);
           }
         }
 
@@ -130,6 +139,9 @@ if (!window.__firefox__) {
 
       // Secure our custom `toString`
       // Freeze our custom `toString`
+      secureToString(toStringString);
+      $.deepFreeze(toStringString);
+
       secureToString(toString);
       $.deepFreeze(toString);