Merge commit from fork

* security: harden Piscina options against prototype pollution

Harden Piscina against prototype pollution by ensuring all
user-controlled option reads come from own properties and by storing
pool options on a null-prototype object.

This prevents attackers who can pollute Object.prototype from
influencing worker configuration (filename, name, transferList,
signal, force) or pool defaults.

NB: pool.options is now a null-prototype object. This is a potential
breaking change for consumers that call Object.prototype methods
directly on pool.options (e.g. pool.options.hasOwnProperty(...)).

* fix: use sanitized options for resourceLimits validation

* fix: sanitize run/close options with withNullPrototype

Use the existing withNullPrototype helper instead of getOwn; address feedback from @metcoder95

* fix: avoid re-linking Object.prototype in Piscina constructor

(cherry picked from commit bebbda2)

Author: Fcmam5

src/common.ts

@@ -60,6 +60,12 @@ export function getAvailableParallelism () : number {
   return availableParallelism();
 }
 
+// Copy own properties onto a prototype-less object, so that options are never
+// resolved through a polluted prototype chain.
+export function withNullPrototype<T extends object>(source: T, overrides?: Partial<T>): T {
+  return Object.assign(Object.create(null), source, overrides)
+}
+
 export function promiseResolvers <T = any> () : 
   { promise: Promise<T>,
     resolve: (res: T) => void,

src/index.ts

@@ -53,6 +53,7 @@ import {
   markMovable,
   getAvailableParallelism,
   maybeFileURLToPath,
+  withNullPrototype,
   promiseResolvers
 } from './common';
 const cpuParallelism : number = getAvailableParallelism();
@@ -191,7 +192,12 @@ class ThreadPool {
 
     const filename =
       options.filename ? maybeFileURLToPath(options.filename) : null;
-    this.options = { ...kDefaultOptions, ...options, filename, maxQueue: 0 };
+    this.options = withNullPrototype({
+      ...kDefaultOptions,
+      ...options,
+      filename,
+      maxQueue: 0,
+    });
 
     if (this.options.recordTiming) {
       this.histogram = new PiscinaHistogramHandler();
@@ -749,8 +755,8 @@ export default class Piscina<T = any, R = any> extends EventEmitterAsyncResource
   #histogram: PiscinaHistogram | null = null;
 
   constructor (options : Options = {}) {
-    const opts = { ...options, '__proto__': null };
-    super({ ...opts, name: 'Piscina' });
+    const opts = withNullPrototype(options);
+    super(withNullPrototype(opts, { name: 'Piscina' }));
 
     if (typeof opts.filename !== 'string' && opts.filename != null) {
       throw new TypeError('options.filename must be a string or null');
@@ -827,12 +833,12 @@ export default class Piscina<T = any, R = any> extends EventEmitterAsyncResource
         new TypeError('options must be an object'));
     }
 
-    const {
-      transferList,
-      signal
-    } = options;
-    const filename = Object.prototype.hasOwnProperty.call(options, 'filename') ? options.filename : null;
-    const name = Object.prototype.hasOwnProperty.call(options, 'name') ? options.name : null;
+    options = withNullPrototype(options);
+
+    const transferList = options.transferList;
+    const signal = options.signal ?? null;
+    const filename = options.filename ?? null;
+    const name = options.name ?? null;
 
     if (transferList !== undefined && !Array.isArray(transferList)) {
       return Promise.reject(
@@ -858,6 +864,8 @@ export default class Piscina<T = any, R = any> extends EventEmitterAsyncResource
       throw TypeError('options must be an object');
     }
 
+    options = withNullPrototype(options);
+
     let { force } = options;
 
     if (force !== undefined && typeof force !== 'boolean') {

test/option-validation.test.ts

@@ -152,4 +152,60 @@ test('trackUnmanagedFds must be a boolean', () => {
   assert.throws(() => new Piscina(({
     trackUnmanagedFds: 'string'
   }) as any), /options.trackUnmanagedFds must be a boolean/);
-});
+});
+
+test('execArgv is not tampered', async () => {
+  (Object.prototype as any).execArgv = ['--not-a-real-flag']
+
+  const pool = new Piscina({
+    filename: resolve(__dirname, 'fixtures/eval.js'),
+    minThreads: 1,
+    maxThreads: 1
+  })
+
+  try {
+    assert.strictEqual(pool.options.execArgv, undefined)
+    assert.strictEqual(await pool.run('42'), 42)
+  } finally {
+    delete (Object.prototype as any).execArgv
+    await pool.close()
+  }
+})
+
+test('loadBalancer is not tampered', async () => {
+  let called = false
+  ;(Object.prototype as any).loadBalancer = () => { called = true; return null }
+
+  const pool = new Piscina({
+    filename: resolve(__dirname, 'fixtures/eval.js'),
+    minThreads: 1,
+    maxThreads: 1
+  })
+
+  try {
+    assert.strictEqual(pool.options.loadBalancer, undefined)
+    assert.strictEqual(await pool.run('42'), 42)
+    assert.strictEqual(called, false)
+  } finally {
+    delete (Object.prototype as any).loadBalancer
+    await pool.close()
+  }
+})
+
+test('env is not tampered', async () => {
+  (Object.prototype as any).env = { NODE_OPTIONS: '--title=polluted' }
+
+  const pool = new Piscina({
+    filename: resolve(__dirname, 'fixtures/eval.js'),
+    minThreads: 1,
+    maxThreads: 1
+  })
+
+  try {
+    assert.strictEqual(pool.options.env, undefined)
+    assert.strictEqual(await pool.run('42'), 42)
+  } finally {
+    delete (Object.prototype as any).env
+    await pool.close()
+  }
+})