diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js index 325df6ca01ad..3f99fe6d161a 100644 --- a/lib/internal/buffer.js +++ b/lib/internal/buffer.js @@ -1148,6 +1148,7 @@ module.exports = { createUnsafeAlignedBuffer, readUInt16BE, readUInt32BE, + hexSlice, asciiWrite, latin1Write, utf8Write, diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js index 3d36c5793bea..7ee103196585 100644 --- a/lib/internal/util/inspect.js +++ b/lib/internal/util/inspect.js @@ -130,7 +130,6 @@ const { WeakSet, WeakSetPrototype, globalThis, - uncurryThis, } = primordials; const { @@ -195,7 +194,10 @@ const { kValidateObjectAllowArray, } = require('internal/validators'); -let hexSlice; +const { + hexSlice, +} = require('internal/buffer'); + let internalUrl; function pathToFileUrlHref(filepath) { @@ -2347,8 +2349,6 @@ function formatArrayBuffer(ctx, value) { } catch { return [ctx.stylize('(detached)', 'special')]; } - if (hexSlice === undefined) - hexSlice = uncurryThis(require('buffer').Buffer.prototype.hexSlice); const rawString = hexSlice(buffer, 0, MathMin(ctx.maxArrayLength, buffer.length)); let str = ''; let i = 0; diff --git a/test/parallel/test-util-inspect-prototype-pollution.mjs b/test/parallel/test-util-inspect-prototype-pollution.mjs new file mode 100644 index 000000000000..40b6ad4a7dc5 --- /dev/null +++ b/test/parallel/test-util-inspect-prototype-pollution.mjs @@ -0,0 +1,10 @@ +import { mustNotCall } from '../common/index.mjs'; +import assert from 'node:assert'; +import { inspect } from 'node:util'; + +// util.inspect must not be affected by userland mutations of Buffer.prototype +Buffer.prototype.hexSlice = mustNotCall(); + +const { buffer } = new Uint8Array([0x04, 0x38, 0x73, 0xE6]); +const expected = 'ArrayBuffer { [Uint8Contents]: <04 38 73 e6>, [byteLength]: 4 }'; +assert.strictEqual(inspect(buffer), expected);