Reject cyclic prototypes on scriptlet proxies

A Proxy without a setPrototypeOf trap passes the call to its target,
whose cycle check stops at the proxy. Akamai Bot Manager's probe
Object.setPrototypeOf(fn, Object.create(fn)) therefore succeeds on
the proxied Function.prototype.toString and leaves a prototype
cycle, so every later toString/.call overflows the stack (seen on
kroger.com, fredmeyer.com).

run() now declares a Proxy that shadows the global for all
scriptlets. It adds a setPrototypeOf trap that rejects a cycle.

Author: qiu-x

build.ts

@@ -1,3 +1,5 @@
+import { createProxy } from './proxy.js';
+
 const tagName = Deno.args.includes('--tagName')
   ? Deno.args[Deno.args.findIndex((o) => o === '--tagName') + 1]
   : false;
@@ -52,7 +54,9 @@ fn: '${scriptlet.fn.name}',
   .join('\n')}
 
 // The calls come last, so the class dependencies, which are not hoisted, are declared by then.
+// Proxy shadows the global for every scriptlet in run(), see proxy.js.
 export function run(scriptletGlobals, calls) {
+const Proxy = (${createProxy})(globalThis.Proxy);
 ${[...functions.values()].join('\n')}
 const table = { ${entries.map((scriptlet) => scriptlet.fn.name).join(', ')} };
 for (const [name, ...args] of calls) {

proxy.js

@@ -0,0 +1,59 @@
+/**
+ * Returns a drop-in replacement for the Proxy constructor whose proxies reject a cyclic
+ * prototype the way a native function does.
+ */
+export function createProxy(NativeProxy) {
+  const reflectGetPrototypeOf = Reflect.getPrototypeOf;
+  const reflectSetPrototypeOf = Reflect.setPrototypeOf;
+  const objectCreate = Object.create;
+  const TypeErrorCtor = TypeError;
+
+  // Native error message
+  let cyclicMessage = 'Cyclic __proto__ value';
+  try {
+    const o = {};
+    Object.setPrototypeOf(o, Object.create(o));
+  } catch (e) {
+    cyclicMessage = e.message;
+  }
+
+  const isCyclic = (proto) => {
+    let slow = proto;
+    let fast = proto;
+    // Classic "tortoise and hare" cycle check
+    while (fast !== null) {
+      fast = reflectGetPrototypeOf(fast);
+      if (fast === null) return false;
+      fast = reflectGetPrototypeOf(fast);
+      slow = reflectGetPrototypeOf(slow);
+      if (fast === slow) return true;
+    }
+    return false;
+  };
+
+  // Set first, then verify the resulting chain and undo a cycle.
+  // A check before the set misses cycles through other proxies stacked on the same target
+  const setPrototypeOf = (target, proto) => {
+    const before = reflectGetPrototypeOf(target);
+    if (reflectSetPrototypeOf(target, proto) === false) return false;
+    let cyclic = true;
+    try {
+      cyclic = proto !== null && isCyclic(proto);
+    } finally {
+      if (cyclic) reflectSetPrototypeOf(target, before);
+    }
+    if (cyclic) throw new TypeErrorCtor(cyclicMessage);
+    return true;
+  };
+
+  return function Proxy(target, handler) {
+    if (new.target === undefined) {
+      throw new TypeErrorCtor("Constructor Proxy requires 'new'");
+    }
+    // Inherit from the handler rather than copy it, so traps defined on a prototype still apply
+    if (handler instanceof Object && handler.setPrototypeOf === undefined) {
+      handler = objectCreate(handler, { setPrototypeOf: { value: setPrototypeOf } });
+    }
+    return new NativeProxy(target, handler);
+  };
+}

test.js

@@ -84,3 +84,42 @@ suite("run()", () => {
     assert.strictEqual(keys.length, 0);
   });
 });
+
+suite("proxied functions", () => {
+  // A fresh realm is the page; returns it with the scriptlet applied
+  function createPage(name, ...args) {
+    const page = vm.createContext({ EventTarget: class {}, Request: class {} });
+    vm.runInContext("self = globalThis; nativeSetTimeout = setTimeout = function setTimeout() {};", page);
+    vm.runInContext(`(${runSource})(...${JSON.stringify([{}, [[scriptlets[name].fn, ...args]]])});`, page);
+    return page;
+  }
+
+  // Akamai Bot Manager's proxy probe: a native function rejects the cyclic prototype, a proxy
+  // forwarding [[SetPrototypeOf]] accepts it and every later lookup on the function overflows
+  const probe = (fn) => `
+    (() => {
+      const fn = ${fn};
+      let error;
+      try { Object.setPrototypeOf(fn, Object.create(fn)); } catch (e) { error = e; }
+      return { name: error?.name, message: error?.message, call: typeof fn.call };
+    })()
+  `;
+  const native = vm.runInContext(probe("function native() {}"), vm.createContext({}));
+
+  for (const [name, fn] of [
+    ["prevent-setTimeout.js", "Function.prototype.toString"], // proxied by proxyApplyFn()
+    ["adjust-setTimeout.js", "setTimeout"], // proxied by the scriptlet itself
+  ]) {
+    test(`${name}: rejects a cyclic prototype on ${fn} like a native function`, () => {
+      const page = createPage(name, "x");
+      assert(vm.runInContext("setTimeout !== nativeSetTimeout", page), `${name} did not run`);
+      assert.deepStrictEqual({ ...vm.runInContext(probe(fn), page) }, { ...native });
+    });
+  }
+
+  test("still sets a non-cyclic prototype", () => {
+    const page = createPage("prevent-setTimeout.js", "x");
+    const set = "const proto = Object.create(Function.prototype); Object.setPrototypeOf(setTimeout, proto) === setTimeout && Object.getPrototypeOf(setTimeout) === proto";
+    assert(vm.runInContext(set, page));
+  });
+});

ubo.js

@@ -807,7 +807,63 @@ fn: 'trustedOverrideElementMethod',
 
 
 // The calls come last, so the class dependencies, which are not hoisted, are declared by then.
+// Proxy shadows the global for every scriptlet in run(), see proxy.js.
 export function run(scriptletGlobals, calls) {
+const Proxy = (function createProxy(NativeProxy) {
+  const reflectGetPrototypeOf = Reflect.getPrototypeOf;
+  const reflectSetPrototypeOf = Reflect.setPrototypeOf;
+  const objectCreate = Object.create;
+  const TypeErrorCtor = TypeError;
+
+  // Native error message
+  let cyclicMessage = 'Cyclic __proto__ value';
+  try {
+    const o = {};
+    Object.setPrototypeOf(o, Object.create(o));
+  } catch (e) {
+    cyclicMessage = e.message;
+  }
+
+  const isCyclic = (proto) => {
+    let slow = proto;
+    let fast = proto;
+    // Classic "tortoise and hare" cycle check
+    while (fast !== null) {
+      fast = reflectGetPrototypeOf(fast);
+      if (fast === null) return false;
+      fast = reflectGetPrototypeOf(fast);
+      slow = reflectGetPrototypeOf(slow);
+      if (fast === slow) return true;
+    }
+    return false;
+  };
+
+  // Set first, then verify the resulting chain and undo a cycle.
+  // A check before the set misses cycles through other proxies stacked on the same target
+  const setPrototypeOf = (target, proto) => {
+    const before = reflectGetPrototypeOf(target);
+    if (reflectSetPrototypeOf(target, proto) === false) return false;
+    let cyclic = true;
+    try {
+      cyclic = proto !== null && isCyclic(proto);
+    } finally {
+      if (cyclic) reflectSetPrototypeOf(target, before);
+    }
+    if (cyclic) throw new TypeErrorCtor(cyclicMessage);
+    return true;
+  };
+
+  return function Proxy(target, handler) {
+    if (new.target === undefined) {
+      throw new TypeErrorCtor("Constructor Proxy requires 'new'");
+    }
+    // Inherit from the handler rather than copy it, so traps defined on a prototype still apply
+    if (handler instanceof Object && handler.setPrototypeOf === undefined) {
+      handler = objectCreate(handler, { setPrototypeOf: { value: setPrototypeOf } });
+    }
+    return new NativeProxy(target, handler);
+  };
+})(globalThis.Proxy);
 function safeSelf() {
     if ( safeSelf.safe ) {
         return safeSelf.safe;