test: add initial pull delay and prototype pollution prevention tests for ReadableStream

[sonsurim]

Added two important tests for the values method of ReadableStream:

• Initial Pull Delay Test
• Prototype Pollution Prevention Test

These tests were added based on the comment in the source code.

Initial Pull Delay Test:
Added a test to ensure that the microtask completes before the controller starts the first read. This is to ensure that the controller is properly initialized before the first read.

Prototype Pollution Prevention Test:
Modified Promise.prototype.then to simulate a prototype pollution scenario and verified that the stream operates correctly. Restored the then method to its original state at the end.

cc. @jasnell

[anonrig]

Why do we need a prototype pollution test?

[sonsurim]

@anonrig Thank you for the review!

During the refactoring process of the values method in the ReadableStream to use a generator, I encountered issues with the Web Platform Tests.

Specifically, the tests failed due to the usage of Promise.prototype.then, which is vulnerable to prototype pollution.
So I thought this requirement was needed not only in the comments but also in the test.

I think prototype pollution test was essential to confirm that the code changes did not negatively impact the stream's behavior.

[benjamingr]

Sure, isn't this already covered in a WPT though?

[benjamingr]

@anonrig

Why do we need a prototype pollution test?

Because it's a web standard and that requires certain behaviors I guess? We can choose not to test/guarantee this in our own abstractions but in standards we implement we should generally follow them as much as we are able to.

[sonsurim]

@benjamingr

Sure, isn't this already covered in a WPT though?

Thank you for the review!

Are you referring to checking for tests in the streams directory of the WPT repository?
If so, I haven't found a test that covers this yet.

Is there anything else I should check? Please let me know and I will look into it right away!

[benjamingr]

@sonsurim I would prefer it if this was tested through the WPTs which means Node and browsers (and other runtimes) would run it and be compatible. https://github.com/web-platform-tests/wpt

That will be pulled automatically the next time WPTs are updates for streams (which is pretty often).

However, if that's too much work from your PoV then I'm fine with landing this and opening an issue at the WPT repo and then migrating when that part happens.

[sonsurim]

@benjamingr

Thank you for the suggestion!
It will take me some time to understand the WPT contribution process.

I would like to proceed with this PR and then open an issue in the WPT repository as you mentioned.

Does that sound okay? 😀

[sonsurim]

@benjamingr

Is it okay if I proceed with this PR as it is now and work on wpt repo as a follow-up PR and pull it to node repo?

If you don't mind, Please let me know!
Many Thanks :)

[benjamingr]

Is it okay if I proceed with this PR as it is now and work on wpt repo as a follow-up PR and pull it to node repo?

Hey yes, this PR isn't blocked - it has an approval (by James) and no blocks. I'll trigger a CI run so after it's green it can land.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/60847/

[nodejs-github-bot]

Landed in d172da8