Repository navigation
Cannot redefine property when accessing properties of freezed global #46788
Description
Activity
The NodeJS docs recommend
Object.freeze(globalThis)as a security best practice (see: https://nodejs.org/en/learn/getting-started/security-best-practices#monkey-patching-cwe-349), so it is somewhat alarming to see that heavily used APIs create these issues.Reacted by Paweł LesieckiI have another reproducer:
node Welcome to Node.js v22.16.0. Type ".help" for more information. > Object.freeze(globalThis); new WebSocket('...') Uncaught: TypeError: Cannot define property Symbol(undici.globalDispatcher.1), object is not extensible at Function.defineProperty (<anonymous>) at setGlobalDispatcher2 (node:internal/deps/undici/undici:8267:14) at lib/global.js (node:internal/deps/undici/undici:8261:7) at __require (node:internal/deps/undici/undici:6:50) at node:internal/deps/undici/undici:13504:52 at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7) at requireBuiltin (node:internal/bootstrap/realm:430:14)This is also a bit annoying because it happens when importing the
httpmodule.
Version
19.3.0
Platform
Darwin * 21.6.0 Darwin Kernel Version 21.6.0: Sat Jun 18 17:07:22 PDT 2022; root:xnu-8020.140.41~1/RELEASE_ARM64_T6000 arm64
Subsystem
No response
What steps will reproduce the bug?
Run
nodeand enterObject.freeze(global);console.log(AbortController)or
Object.freeze(global);console.log(MessageChannel)How often does it reproduce? Is there a required condition?
since v19.3
What is the expected behavior?
No error, just like for v19.2
What do you see instead?
Additional information
No response