lib: use null-prototype objects for property descriptors

Refs: #42921
PR-URL: #43270
Backport-PR-URL: #43804
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Minwoo Jung <nodecorelab@gmail.com>

lib/_http_incoming.js

@@ -98,6 +98,7 @@ ObjectSetPrototypeOf(IncomingMessage.prototype, Readable.prototype);
 ObjectSetPrototypeOf(IncomingMessage, Readable);
 
 ObjectDefineProperty(IncomingMessage.prototype, 'connection', {
+  __proto__: null,
   get: function() {
     return this.socket;
   },
@@ -107,6 +108,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'connection', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
+  __proto__: null,
   get: function() {
     if (!this[kHeaders]) {
       this[kHeaders] = {};
@@ -126,6 +128,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headers', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'headersDistinct', {
+  __proto__: null,
   get: function() {
     if (!this[kHeadersDistinct]) {
       this[kHeadersDistinct] = {};
@@ -145,6 +148,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'headersDistinct', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'trailers', {
+  __proto__: null,
   get: function() {
     if (!this[kTrailers]) {
       this[kTrailers] = {};
@@ -164,6 +168,7 @@ ObjectDefineProperty(IncomingMessage.prototype, 'trailers', {
 });
 
 ObjectDefineProperty(IncomingMessage.prototype, 'trailersDistinct', {
+  __proto__: null,
   get: function() {
     if (!this[kTrailersDistinct]) {
       this[kTrailersDistinct] = {};

lib/_http_outgoing.js

@@ -145,6 +145,7 @@ ObjectSetPrototypeOf(OutgoingMessage.prototype, Stream.prototype);
 ObjectSetPrototypeOf(OutgoingMessage, Stream);
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableFinished', {
+  __proto__: null,
   get() {
     return (
       this.finished &&
@@ -155,31 +156,36 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'writableFinished', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableObjectMode', {
+  __proto__: null,
   get() {
     return false;
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableLength', {
+  __proto__: null,
   get() {
     return this.outputSize + (this.socket ? this.socket.writableLength : 0);
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableHighWaterMark', {
+  __proto__: null,
   get() {
     return this.socket ? this.socket.writableHighWaterMark : HIGH_WATER_MARK;
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableCorked', {
+  __proto__: null,
   get() {
     const corked = this.socket ? this.socket.writableCorked : 0;
     return corked + this[kCorked];
   }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, '_headers', {
+  __proto__: null,
   get: internalUtil.deprecate(function() {
     return this.getHeaders();
   }, 'OutgoingMessage.prototype._headers is deprecated', 'DEP0066'),
@@ -200,6 +206,7 @@ ObjectDefineProperty(OutgoingMessage.prototype, '_headers', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'connection', {
+  __proto__: null,
   get: function() {
     return this.socket;
   },
@@ -209,6 +216,7 @@ ObjectDefineProperty(OutgoingMessage.prototype, 'connection', {
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, '_headerNames', {
+  __proto__: null,
   get: internalUtil.deprecate(function() {
     const headers = this[kOutHeaders];
     if (headers !== null) {
@@ -731,16 +739,19 @@ OutgoingMessage.prototype._implicitHeader = function _implicitHeader() {
 };
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'headersSent', {
+  __proto__: null,
   configurable: true,
   enumerable: true,
   get: function() { return !!this._header; }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableEnded', {
+  __proto__: null,
   get: function() { return this.finished; }
 });
 
 ObjectDefineProperty(OutgoingMessage.prototype, 'writableNeedDrain', {
+  __proto__: null,
   get: function() {
     return !this.destroyed && !this.finished && this[kNeedDrain];
   }

lib/_tls_wrap.js

@@ -633,6 +633,7 @@ TLSSocket.prototype._wrapHandle = function(wrap) {
 // Ref: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
 function defineHandleReading(socket, handle) {
   ObjectDefineProperty(handle, 'reading', {
+    __proto__: null,
     get: () => {
       return socket[kRes].reading;
     },

lib/async_hooks.js

@@ -239,12 +239,14 @@ class AsyncResource {
     }
     ObjectDefineProperties(bound, {
       'length': {
+        __proto__: null,
         configurable: true,
         enumerable: false,
         value: fn.length,
         writable: false,
       },
       'asyncResource': {
+        __proto__: null,
         configurable: true,
         enumerable: true,
         value: this,

lib/buffer.js

@@ -282,6 +282,7 @@ function Buffer(arg, encodingOrOffset, length) {
 }
 
 ObjectDefineProperty(Buffer, SymbolSpecies, {
+  __proto__: null,
   enumerable: false,
   configurable: true,
   get() { return FastBuffer; }
@@ -757,6 +758,7 @@ Buffer.byteLength = byteLength;
 
 // For backwards compatibility.
 ObjectDefineProperty(Buffer.prototype, 'parent', {
+  __proto__: null,
   enumerable: true,
   get() {
     if (!(this instanceof Buffer))
@@ -765,6 +767,7 @@ ObjectDefineProperty(Buffer.prototype, 'parent', {
   }
 });
 ObjectDefineProperty(Buffer.prototype, 'offset', {
+  __proto__: null,
   enumerable: true,
   get() {
     if (!(this instanceof Buffer))
@@ -1284,11 +1287,13 @@ module.exports = {
 
 ObjectDefineProperties(module.exports, {
   constants: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     value: constants
   },
   INSPECT_MAX_BYTES: {
+    __proto__: null,
     configurable: true,
     enumerable: true,
     get() { return INSPECT_MAX_BYTES; },

lib/child_process.js

@@ -247,6 +247,7 @@ const customPromiseExecFunction = (orig) => {
 };
 
 ObjectDefineProperty(exec, promisify.custom, {
+  __proto__: null,
   enumerable: false,
   value: customPromiseExecFunction(exec)
 });
@@ -498,6 +499,7 @@ function execFile(file, args = [], options, callback) {
 }
 
 ObjectDefineProperty(execFile, promisify.custom, {
+  __proto__: null,
   enumerable: false,
   value: customPromiseExecFunction(execFile)
 });

lib/crypto.js

@@ -248,26 +248,31 @@ function getFipsForced() {
 }
 
 ObjectDefineProperty(constants, 'defaultCipherList', {
+  __proto__: null,
   value: getOptionValue('--tls-cipher-list')
 });
 
 ObjectDefineProperties(module.exports, {
   createCipher: {
+    __proto__: null,
     enumerable: false,
     value: deprecate(createCipher,
                      'crypto.createCipher is deprecated.', 'DEP0106')
   },
   createDecipher: {
+    __proto__: null,
     enumerable: false,
     value: deprecate(createDecipher,
                      'crypto.createDecipher is deprecated.', 'DEP0106')
   },
   // crypto.fips is deprecated. DEP0093. Use crypto.getFips()/crypto.setFips()
   fips: {
+    __proto__: null,
     get: fipsForced ? getFipsForced : getFipsCrypto,
     set: fipsForced ? setFipsForced : setFipsCrypto
   },
   DEFAULT_ENCODING: {
+    __proto__: null,
     enumerable: false,
     configurable: true,
     get: deprecate(getDefaultEncoding,
@@ -276,12 +281,14 @@ ObjectDefineProperties(module.exports, {
                    'crypto.DEFAULT_ENCODING is deprecated.', 'DEP0091')
   },
   constants: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     value: constants
   },
 
   webcrypto: {
+    __proto__: null,
     configurable: false,
     enumerable: true,
     get() { return lazyRequire('internal/crypto/webcrypto').crypto; }

lib/dgram.js

@@ -971,6 +971,7 @@ Socket.prototype.getSendBufferSize = function() {
 
 // Deprecated private APIs.
 ObjectDefineProperty(Socket.prototype, '_handle', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].handle;
   }, 'Socket.prototype._handle is deprecated', 'DEP0112'),
@@ -981,6 +982,7 @@ ObjectDefineProperty(Socket.prototype, '_handle', {
 
 
 ObjectDefineProperty(Socket.prototype, '_receiving', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].receiving;
   }, 'Socket.prototype._receiving is deprecated', 'DEP0112'),
@@ -991,6 +993,7 @@ ObjectDefineProperty(Socket.prototype, '_receiving', {
 
 
 ObjectDefineProperty(Socket.prototype, '_bindState', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].bindState;
   }, 'Socket.prototype._bindState is deprecated', 'DEP0112'),
@@ -1001,6 +1004,7 @@ ObjectDefineProperty(Socket.prototype, '_bindState', {
 
 
 ObjectDefineProperty(Socket.prototype, '_queue', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].queue;
   }, 'Socket.prototype._queue is deprecated', 'DEP0112'),
@@ -1011,6 +1015,7 @@ ObjectDefineProperty(Socket.prototype, '_queue', {
 
 
 ObjectDefineProperty(Socket.prototype, '_reuseAddr', {
+  __proto__: null,
   get: deprecate(function() {
     return this[kStateSymbol].reuseAddr;
   }, 'Socket.prototype._reuseAddr is deprecated', 'DEP0112'),
@@ -1033,6 +1038,7 @@ Socket.prototype._stopReceiving = deprecate(function() {
 // Legacy alias on the C++ wrapper object. This is not public API, so we may
 // want to runtime-deprecate it at some point. There's no hurry, though.
 ObjectDefineProperty(UDP.prototype, 'owner', {
+  __proto__: null,
   get() { return this[owner_symbol]; },
   set(v) { return this[owner_symbol] = v; }
 });

lib/dns.js

@@ -191,7 +191,7 @@ function lookup(hostname, options, callback) {
 }
 
 ObjectDefineProperty(lookup, customPromisifyArgs,
-                     { value: ['address', 'family'], enumerable: false });
+                     { __proto__: null, value: ['address', 'family'], enumerable: false });
 
 
 function onlookupservice(err, hostname, service) {
@@ -240,7 +240,7 @@ function lookupService(address, port, callback) {
 }
 
 ObjectDefineProperty(lookupService, customPromisifyArgs,
-                     { value: ['hostname', 'service'], enumerable: false });
+                     { __proto__: null, value: ['hostname', 'service'], enumerable: false });
 
 
 function onresolve(err, result, ttls) {
@@ -289,7 +289,7 @@ function resolver(bindingName) {
     }
     return req;
   }
-  ObjectDefineProperty(query, 'name', { value: bindingName });
+  ObjectDefineProperty(query, 'name', { __proto__: null, value: bindingName });
   return query;
 }
 
@@ -382,6 +382,7 @@ bindDefaultResolver(module.exports, getDefaultResolver());
 
 ObjectDefineProperties(module.exports, {
   promises: {
+    __proto__: null,
     configurable: true,
     enumerable: true,
     get() {

lib/domain.js

@@ -59,6 +59,7 @@ const { WeakReference } = internalBinding('util');
 // effective optimizations
 const _domain = [null];
 ObjectDefineProperty(process, 'domain', {
+  __proto__: null,
   enumerable: true,
   get: function() {
     return _domain[0];
@@ -78,6 +79,7 @@ const asyncHook = createHook({
       // have a domain property as it can be used to escape the sandbox.
       if (type !== 'PROMISE' || resource instanceof Promise) {
         ObjectDefineProperty(resource, 'domain', {
+          __proto__: null,
           configurable: true,
           enumerable: false,
           value: process.domain,
@@ -231,6 +233,7 @@ Domain.prototype._errorHandler = function(er) {
 
   if ((typeof er === 'object' && er !== null) || typeof er === 'function') {
     ObjectDefineProperty(er, 'domain', {
+      __proto__: null,
       configurable: true,
       enumerable: false,
       value: this,
@@ -356,6 +359,7 @@ Domain.prototype.add = function(ee) {
   }
 
   ObjectDefineProperty(ee, 'domain', {
+    __proto__: null,
     configurable: true,
     enumerable: false,
     value: this,
@@ -388,6 +392,7 @@ function intercepted(_this, self, cb, fnargs) {
     er.domainBound = cb;
     er.domainThrown = false;
     ObjectDefineProperty(er, 'domain', {
+      __proto__: null,
       configurable: true,
       enumerable: false,
       value: self,
@@ -433,6 +438,7 @@ Domain.prototype.bind = function(cb) {
   }
 
   ObjectDefineProperty(runBound, 'domain', {
+    __proto__: null,
     configurable: true,
     enumerable: false,
     value: this,
@@ -448,6 +454,7 @@ EventEmitter.usingDomains = true;
 const eventInit = EventEmitter.init;
 EventEmitter.init = function(opts) {
   ObjectDefineProperty(this, 'domain', {
+    __proto__: null,
     configurable: true,
     enumerable: false,
     value: null,
@@ -482,6 +489,7 @@ EventEmitter.prototype.emit = function emit(...args) {
     if (typeof er === 'object') {
       er.domainEmitter = this;
       ObjectDefineProperty(er, 'domain', {
+        __proto__: null,
         configurable: true,
         enumerable: false,
         value: domain,