node: warn for Object.prototype.__* accessors common in security warnings

doc/api/deprecations.md

@@ -2801,7 +2801,30 @@ non-number value for `hints` option, a non-nullish non-boolean value for `all`
 option, or a non-nullish non-boolean value for `verbatim` option in
 [`dns.lookup()`][] and [`dnsPromises.lookup()`][] is deprecated.
 
+### DEP0XXX: `Object.prototype` Legacy Accessors
+<!-- YAML
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/39824
+    description: Runtime deprecation.
+-->
+
+Type: Runtime
+
+Accessors on `Object.prototype` are subject to object traversal attacks and
+cause concerns for security audits. A variety of these are deprecated
+by [Legacy Object.prototype Accessor Methods][]. Modern
+replacements are `Object.defineProperty`, `Object.getPrototypeOf`, and
+`Object.setPrototypeOf` and not subject to path traversal. This affects:
+
+* `Object.prototype.__defineGetter__`
+* `Object.prototype.__defineSetter__`
+* `Object.prototype.__lookupGetter__`
+* `Object.prototype.__lookupSetter__`
+* `Object.prototype.__proto__`
+
 [Legacy URL API]: url.md#url_legacy_url_api
+[Legacy Object.prototype Accessor Methods]: https://tc39.es/ecma262/#sec-object.prototype-legacy-accessor-methods
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
 [WHATWG URL API]: url.md#url_the_whatwg_url_api

lib/internal/bootstrap/pre_execution.js

@@ -3,10 +3,13 @@
 const {
   NumberParseInt,
   ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectPrototype,
   SafeMap,
   SafeWeakMap,
   StringPrototypeStartsWith,
   globalThis,
+  uncurryThis,
 } = primordials;
 
 const {
@@ -332,6 +335,58 @@ function initializeDeprecations() {
     enumerable: false,
     configurable: true
   });
+
+  if (pendingDeprecation) {
+    const legacy = [
+      ['__proto__', {
+        get: 'Object.getPrototypeOf',
+        set: 'Object.setPrototypeOf'
+      }],
+      ['__defineGetter__', 'Object.defineProperty'],
+      ['__defineSetter__', 'Object.defineProperty'],
+      ['__lookupGetter__', 'Object.getOwnPropertyDescriptor'],
+      ['__lookupSetter__', 'Object.getOwnPropertyDescriptor'],
+    ];
+    for (let i = 0; i < legacy.length; i++) {
+      const prop = legacy[i][0];
+      const replacement = legacy[i][1];
+      const getReplacement = typeof replacement === 'string' ?
+        replacement : replacement.get;
+      const setReplacement = typeof replacement === 'string' ?
+        replacement : replacement.set;
+      const protoDescriptor = ObjectGetOwnPropertyDescriptor(
+        ObjectPrototype,
+        prop);
+      if (protoDescriptor && 'value' in protoDescriptor) {
+        let value = protoDescriptor.value;
+        const writable = protoDescriptor.writable;
+        ObjectDefineProperty(ObjectPrototype, prop, {
+          get: deprecate(function() {
+            return value;
+          }, `${prop} is deprecated, use ${getReplacement} instead`, 'DEP0XXX'),
+          set: deprecate(function(v) {
+            if (!writable) return;
+            value = v;
+          }, `${prop} is deprecated, use ${setReplacement} instead`, 'DEP0XXX'),
+          enumerable: false,
+          configurable: true
+        });
+      } else {
+        const getter = uncurryThis(protoDescriptor.get);
+        const setter = uncurryThis(protoDescriptor.set);
+        ObjectDefineProperty(ObjectPrototype, prop, {
+          get: deprecate(function() {
+            return getter(this);
+          }, `${prop} is deprecated, use ${getReplacement} instead`, 'DEP0XXX'),
+          set: deprecate(function(value) {
+            setter(this, value);
+          }, `${prop} is deprecated, use ${setReplacement} instead`, 'DEP0XXX'),
+          enumerable: false,
+          configurable: true
+        });
+      }
+    }
+  }
 }
 
 function setupChildProcessIpcChannel() {

test/parallel/test-object-proto-accessor-warning.js

@@ -0,0 +1,14 @@
+// Flags: --pending-deprecation
+'use strict';
+
+const common = require('../common');
+
+common.expectWarning(
+  'DeprecationWarning',
+  '__proto__ is deprecated, use Object.getPrototypeOf instead', 'DEP0XXX');
+
+const obj = {};
+// eslint-disable-next-line
+const _ = obj.__proto__;
+// eslint-disable-next-line
+obj.__proto__ = null;

test/parallel/test-repl-tab-complete.js

@@ -550,6 +550,7 @@ testMe.complete('obj.', common.mustCall(function(error, data) {
 
     data[0].forEach((key) => {
       if (!key || key === 'ele.biu') return;
+      console.error(key, ele[key.substr(4)]);
       assert.notStrictEqual(ele[key.substr(4)], undefined);
     });
   }));