fix: use CreateDataProperty when copying objects across contextBridge (#51085)

Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <sattard@anthropic.com>
This commit is contained in:
trop[bot]
2026-04-16 10:57:32 -07:00
committed by GitHub
parent ac39421bd0
commit 23a6efb714
2 changed files with 58 additions and 1 deletions

View File

@@ -725,7 +725,18 @@ v8::MaybeLocal<v8::Object> CreateProxyForAPI(
{
v8::Context::Scope inner_destination_context_scope(
destination_context);
proxy.Set(key, passed_value.ToLocalChecked());
// Use CreateDataProperty (not Set) so that a key named "__proto__"
// becomes an own data property instead of invoking the inherited
// Object.prototype.__proto__ setter and mutating the prototype.
v8::Local<v8::Value> proxied_value = passed_value.ToLocalChecked();
if (key->IsName()) {
std::ignore = proxy.GetHandle()->CreateDataProperty(
destination_context, key.As<v8::Name>(), proxied_value);
} else {
std::ignore = proxy.GetHandle()->CreateDataProperty(
destination_context, key.As<v8::Uint32>()->Value(),
proxied_value);
}
}
}
}