util: never trigger any proxy traps using format()

PR-URL: #30767
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

lib/internal/util/inspect.js

@@ -1648,6 +1648,13 @@ function reduceToSingleString(
 }
 
 function hasBuiltInToString(value) {
+  // Prevent triggering proxy traps.
+  const getFullProxy = false;
+  const proxyTarget = getProxyDetails(value, getFullProxy);
+  if (proxyTarget !== undefined) {
+    value = proxyTarget;
+  }
+
   // Count objects that have no `toString` function as built-in.
   if (typeof value.toString !== 'function') {
     return true;

test/parallel/test-util-inspect-proxy.js

@@ -41,6 +41,9 @@ proxyObj = new Proxy(target, handler);
 // Inspecting the proxy should not actually walk it's properties
 util.inspect(proxyObj, opts);
 
+// Make sure inspecting object does not trigger any proxy traps.
+util.format('%s', proxyObj);
+
 // getProxyDetails is an internal method, not intended for public use.
 // This is here to test that the internals are working correctly.
 let details = processUtil.getProxyDetails(proxyObj, true);