ObjectWrap/NODE_SET_PROTOTYPE_METHOD/node::SetPrototypeMethod is unsafe

[cscott]

SetPrototypeMethod should set a Signature on the FunctionTemplate, to prevent issues like TryGhost/node-sqlite3#236

When used in conjunction with ObjectWrap, w/o a signature it is possible to pass bogus things as this, which could become a security hole.

[rvagg]

@cscott do you think you could provide a basic pull-request for this just to demonstrate what you're suggesting? I think you're going to have to communicate this better to get any action here.

[cscott]

@rvagg done (PR #7261, see above). Note that (1) I haven't even built this patch yet, (2) there are a number of minor issues with the commit message, (3) I'm not in the CLA, and (4) i haven't added a test case. But perhaps it will get the ball rolling?

[rvagg]

cool, thanks @cscott, I think the core guys are super busy at the moment so probably don't have a whole lot of bandwidth to absorb this and it's not exactly a straightforward thing to absorb!

[cscott]

Fixed the issues above in the latest patch at PR #7261 although there are more test cases that could be written.