lib: use Web IDL interface brand checks

Use explicit brand predicates for interface conversion instead of
prototype ancestry. Update CryptoKey and AbortSignal together with the
shared converter contract.

Read internal AbortSignal state during composition. Preserve genuine
signals after prototype changes without invoking shadowed getters.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: GitHub Copilot
PR-URL: #65846
Backport-PR-URL: #66233
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

lib/internal/abort_controller.js

@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
   }
@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
 
@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {
 }
 
 class AbortSignal extends EventTarget {
+  #brand;
+
+  static {
+    converters.AbortSignal = createInterfaceConverter(
+      'AbortSignal',
+      (value) => typeof value === 'object' && value !== null && #brand in value,
+    );
+  }
 
   /**
    * @param {symbol | undefined} dontThrowSymbol
@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {
         gcPersistentSignals.add(signal);
       }
 
-      if (signal.aborted) {
-        abortSignal(resultSignal, signal.reason);
+      refreshCompositeSignal(signal);
+      if (signal[kAborted]) {
+        abortSignal(resultSignal, signal[kReason]);
         return resultSignal;
       }
 
@@ -348,20 +357,15 @@ class AbortSignal extends EventTarget {
       } else if (!signal[kSourceSignals]) {
         continue;
       } else {
-        refreshCompositeSignal(signal);
-        if (signal.aborted) {
-          abortSignal(resultSignal, signal.reason);
-          return resultSignal;
-        }
         for (const sourceSignalWeakRef of signal[kSourceSignals]) {
           const sourceSignal = sourceSignalWeakRef.deref();
           if (!sourceSignal) {
             continue;
           }
           assert(!sourceSignal[kComposite]);
 
-          if (sourceSignal.aborted) {
-            abortSignal(resultSignal, sourceSignal.reason);
+          if (sourceSignal[kAborted]) {
+            abortSignal(resultSignal, sourceSignal[kReason]);
             return resultSignal;
           }
 
@@ -470,7 +474,6 @@ class AbortSignal extends EventTarget {
   }
 }
 
-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);
 converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);
 
 function ClonedAbortSignal() {

lib/internal/crypto/webidl.js

@@ -19,10 +19,10 @@ const {
   isInt32,
   isUint32,
 } = require('internal/validators');
-const { CryptoKey } = require('internal/crypto/webcrypto');
 const {
   getCryptoKeyAlgorithm,
   getCryptoKeyType,
+  isCryptoKey,
 } = require('internal/crypto/keys');
 const {
   bigIntArrayToUnsignedInt,
@@ -649,7 +649,7 @@ converters.AesCtrParams = createDictionaryConverter(
   ]);
 
 converters.CryptoKey = createInterfaceConverter(
-  'CryptoKey', CryptoKey.prototype);
+  'CryptoKey', isCryptoKey);
 
 converters.EcdhKeyDeriveParams = createDictionaryConverter(
   'EcdhKeyDeriveParams', [

lib/internal/webidl.js

@@ -21,7 +21,6 @@ const {
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
   ObjectPrototypeHasOwnProperty,
-  ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
   String,
@@ -863,13 +862,13 @@ function createSequenceConverter(converter) {
  * Creates a converter for a Web IDL interface type.
  * @see https://webidl.spec.whatwg.org/#js-interface
  * @param {string} name Interface identifier.
- * @param {object} prototype Interface prototype object.
+ * @param {(value: any) => boolean} brandCheck Interface brand predicate.
  * @returns {Converter}
  */
-function createInterfaceConverter(name, prototype) {
+function createInterfaceConverter(name, brandCheck) {
   return (V, options = kEmptyObject) => {
     // Web IDL interface conversion step 1: return V if it implements I.
-    if (ObjectPrototypeIsPrototypeOf(prototype, V)) {
+    if (brandCheck(V)) {
       return V;
     }
     // Step 2: otherwise throw.

test/parallel/test-internal-webidl.js

@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const vm = require('vm');
 const webidl = require('internal/webidl');
@@ -544,10 +544,16 @@ for (const [prototype, value] of [
 }
 
 {
-  class Example {}
+  class Example {
+    #brand;
+
+    static is(value) {
+      return typeof value === 'object' && value !== null && #brand in value;
+    }
+  }
   const converter = webidl.createInterfaceConverter(
     'Example',
-    Example.prototype);
+    Example.is);
   const example = new Example();
 
   assert.strictEqual(converter(example), example);
@@ -556,6 +562,42 @@ for (const [prototype, value] of [
     code: 'ERR_INVALID_ARG_TYPE',
     message: 'Prefix: Context is not of type Example.',
   });
+  assertInvalidArgType(() => converter({ __proto__: Example.prototype }));
+  assertInvalidArgType(() => converter(new Proxy(example, {})));
+  Object.setPrototypeOf(example, null);
+  assert.strictEqual(converter(example), example);
+}
+
+{
+  const signal = AbortSignal.abort('reason');
+  for (const value of [
+    Object.create(AbortSignal.prototype, { aborted: { value: false } }),
+    { __proto__: signal },
+    Object.create(AbortSignal.prototype, Object.getOwnPropertyDescriptors(signal)),
+    new Proxy(signal, {}),
+  ]) {
+    assertInvalidArgType(() => converters.AbortSignal(value));
+    assertInvalidArgType(() => AbortSignal.any([value]));
+  }
+
+  Object.setPrototypeOf(signal, null);
+  assert.strictEqual(converters.AbortSignal(signal), signal);
+  const composite = AbortSignal.any([signal]);
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
+}
+
+{
+  const controller = new AbortController();
+  Object.defineProperties(controller.signal, {
+    aborted: { get: common.mustNotCall('Unexpected aborted getter') },
+    reason: { get: common.mustNotCall('Unexpected reason getter') },
+  });
+  const composite = AbortSignal.any([controller.signal]);
+  assert.strictEqual(composite.aborted, false);
+  controller.abort('reason');
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
 }
 
 {

test/parallel/test-webcrypto-cryptokey-brand-check.js

@@ -54,6 +54,7 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(Object.getPrototypeOf(internalProto), CryptoKey.prototype);
 
   const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+  const invalidArgType = { code: 'ERR_INVALID_ARG_TYPE', name: 'TypeError' };
 
   // Plain object receiver.
   Object.entries(getters).forEach(([, getter]) => {
@@ -94,10 +95,10 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(isCryptoKey(spoofed), false);
   await assert.rejects(
     subtle.sign('HMAC', spoofed, Buffer.from('payload')),
-    invalidThis);
+    invalidArgType);
   await assert.rejects(
     subtle.exportKey('jwk', spoofed),
-    invalidThis);
+    invalidArgType);
 
   // Subvert `instanceof CryptoKey` via Symbol.hasInstance, then
   // invoke the native getters on a forged object. The C++ tag

test/parallel/test-webcrypto-webidl-brand.js

@@ -0,0 +1,38 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+const { CryptoKey } = require('internal/crypto/keys');
+const { converters } = require('internal/crypto/webidl');
+
+async function main() {
+  const bytes = new Uint8Array(16);
+  const key = await subtle.importKey('raw', bytes, 'AES-GCM', true, ['encrypt']);
+
+  for (const value of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    Object.create(CryptoKey.prototype, Object.getOwnPropertyDescriptors(key)),
+    new Proxy(key, {}),
+  ]) {
+    assert.throws(() => converters.CryptoKey(value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+    await assert.rejects(subtle.exportKey('raw', value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  Object.setPrototypeOf(key, null);
+  assert.strictEqual(converters.CryptoKey(key), key);
+  assert.deepStrictEqual(new Uint8Array(await subtle.exportKey('raw', key)), bytes);
+}
+
+main().then(common.mustCall());