DeepSeek/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(code-runtime): reject forged container prototypes

Browse Source
This commit is contained in:
Tianyi Cui
2026-07-23 02:01:04 +08:00
parent 8379101e3b
commit e9e450a902
7 changed files with 77 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
packages/code-runtime/code-runtime-worker/tests/worker-json.spec.ts
View File

@@ -97,6 +97,19 @@ describe('snapshotCodeJsonValue', () => {
Object.setPrototypeOf(forgedPrototype, null)
const forgedArray = [1]
Object.setPrototypeOf(forgedArray, forgedPrototype)
const spoofedObjectPrototype = Object.create(null) as Record<string, unknown>
const SpoofedObject = function Object() {}
SpoofedObject.prototype = spoofedObjectPrototype
Object.defineProperty(spoofedObjectPrototype, 'constructor', { value: SpoofedObject })
const spoofedObject = Object.create(spoofedObjectPrototype) as Record<string, unknown>
spoofedObject.value = 1
const spoofedArrayPrototype: unknown[] = []
Object.setPrototypeOf(spoofedArrayPrototype, Object.prototype)
const SpoofedArray = function Array() {}
SpoofedArray.prototype = spoofedArrayPrototype
Object.defineProperty(spoofedArrayPrototype, 'constructor', { value: SpoofedArray })
const spoofedArray = [1]
Object.setPrototypeOf(spoofedArray, spoofedArrayPrototype)
for (const value of [
new ExoticObject(),
@@ -110,11 +123,15 @@ describe('snapshotCodeJsonValue', () => {
symbolObject,
customPrototypeObject,
forgedArray,
spoofedObject,
spoofedArray,
cyclic,
[undefined],
{ value: undefined },
]) {
expect(snapshotCodeJsonValue(value)).toBeUndefined()
const canonical = snapshotJsonValue(value)
expect(canonical).toBeUndefined()
expect(snapshotCodeJsonValue(value)).toEqual(canonical)
}
})