track-turns doesn't guard against overridden .catch method

[warner]

@erights and I were investigating a potential object-retention problem with the track-turns implementation, when we noticed that the following line:

endo/packages/eventual-send/src/track-turns.js

Line 81 in 1895f5b

Promise.resolve(result).catch(reason => {

would be vulnerable to the wrapped function's return value being a real Promise but whose .catch method had been overridden. I haven't tried to build an exploit, but I think it would look something like this:

function foo(args) {
   stuff(args);
   const fakePromise = new Promise((res, rej) => stuff(res, resj));
   const oldCatch = fakePromise.catch;
    fakePromise.catch = handler => {
      console.log(`handler I'm not supposed to be able to see:`, handler);
      return oldCatch(handler);
    };
    return fakePromise;
}
const target = Far('', { foo });

E(target).foo(args);

The track-turns mechanism is supposed to be invisible to user code, but the fake catch would get to see the track-turns internal function that adds a rejection note to any error it emits.

I'm guessing the way to fix this would be to replace the Promise.resolve(result).catch(..) with an E.when(result).catch(..), but I'm not positive.

cc @erights @michaelfig

[erights]

cc @mhofman

[erights]

I'm guessing the way to fix this would be to replace the Promise.resolve(result).catch(..) with an E.when(result).catch(..), but I'm not positive.

except that we need to avoid the infinite regress of E.when using trackTurns in its implementation ;)