lib: fix shared buffer growability validation

Use the intrinsic growable getter instead of buffer.growable so
shadowed properties cannot bypass validation or reject fixed buffers.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: GitHub Copilot
PR-URL: #65845
Backport-PR-URL: #66233
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>

Author: panva

lib/internal/webidl.js

@@ -36,6 +36,8 @@ const {
   isTypedArray,
 } = require('internal/util/types');
 
+const { getSharedArrayBufferGrowable } = internalBinding('util');
+
 const BIGINT_2_63 = 1n << 63n;
 const BIGINT_2_64 = 1n << 64n;
 
@@ -934,12 +936,8 @@ function validateBufferSourceBacking(buffer, options) {
 function validateAllowGrowableSharedArrayBuffer(buffer, options) {
   // SharedArrayBuffer and ArrayBufferView conversion step 3:
   // IsFixedLengthArrayBuffer(buffer) must be true without [AllowResizable].
-  // Do not use a primordial getter here. When this module is included in the
-  // startup snapshot, an early-captured SharedArrayBuffer.prototype.growable
-  // getter does not detect growable buffers created after deserialization.
-  // Lazily capturing the getter would work, but it would observe the runtime
-  // prototype at first comparison, so it would not be an actual primordial.
-  if (!options.allowResizable && buffer.growable) {
+  if (!options.allowResizable &&
+      FunctionPrototypeCall(getSharedArrayBufferGrowable, buffer)) {
     throw makeException(
       'is backed by a growable SharedArrayBuffer, which is not allowed.',
       options);

src/node_util.cc

@@ -520,6 +520,25 @@ void Initialize(Local<Object> target,
   Environment* env = Environment::GetCurrent(context);
   Isolate* isolate = env->isolate();
 
+  {
+    const Local<Object> prototype =
+        SharedArrayBuffer::New(isolate, 0)->GetPrototypeV2().As<Object>();
+    const Local<Object> descriptor =
+        prototype
+            ->GetOwnPropertyDescriptor(
+                context, FIXED_ONE_BYTE_STRING(isolate, "growable"))
+            .ToLocalChecked()
+            .As<Object>();
+    const Local<Value> getter =
+        descriptor->Get(context, env->get_string()).ToLocalChecked();
+    CHECK(getter->IsFunction());
+    target
+        ->Set(context,
+              FIXED_ONE_BYTE_STRING(isolate, "getSharedArrayBufferGrowable"),
+              getter)
+        .Check();
+  }
+
   {
     Local<ObjectTemplate> tmpl = ObjectTemplate::New(isolate);
 #define V(PropertyName, _)                                                     \

test/parallel/test-internal-webidl-buffer-source.js

@@ -1,7 +1,7 @@
-// Flags: --expose-internals
+// Flags: --expose-internals --experimental-wasm-rab-integration
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { test } = require('node:test');
 const vm = require('vm');
@@ -272,6 +272,92 @@ test('AllowSharedBufferSource handles growable shared buffers with explicit ' +
   }
 });
 
+test('Shared buffer growability checks do not read JavaScript properties', () => {
+  for (const [buffer, growable] of [
+    [new SharedArrayBuffer(8), false],
+    [new SharedArrayBuffer(8, { maxByteLength: 8 }), true],
+    [new SharedArrayBuffer(8, { maxByteLength: 16 }), true],
+    [vm.runInNewContext('new SharedArrayBuffer(8)'), false],
+    [vm.runInNewContext('new SharedArrayBuffer(8, { maxByteLength: 16 })'), true],
+  ]) {
+    const view = new Uint8Array(buffer);
+    const dataView = new DataView(buffer);
+    for (const mode of ['shadow', 'getter', 'prototype']) {
+      if (mode === 'shadow') {
+        Object.defineProperty(buffer, 'growable', {
+          value: !growable,
+          configurable: true,
+        });
+      } else if (mode === 'getter') {
+        Object.defineProperty(buffer, 'growable', {
+          get: common.mustNotCall('Unexpected growable getter'),
+          configurable: true,
+        });
+      } else {
+        delete buffer.growable;
+        Object.setPrototypeOf(buffer, null);
+      }
+
+      for (const value of [buffer, view, dataView]) {
+        if (growable) {
+          assert.throws(() => converters.AllowSharedBufferSource(value), {
+            code: 'ERR_INVALID_ARG_TYPE',
+          });
+        } else {
+          assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+        }
+        assert.strictEqual(converters.AllowSharedBufferSource(value, {
+          allowResizable: true,
+        }), value);
+      }
+
+      if (growable) {
+        assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+      }
+      assert.strictEqual(converters.Uint8Array(view, {
+        allowShared: true,
+        allowResizable: true,
+      }), view);
+    }
+  }
+});
+
+test('Shared WebAssembly buffer growability is checked per buffer', {
+  skip: typeof WebAssembly === 'undefined',
+}, () => {
+  const memory = new WebAssembly.Memory({ initial: 1, maximum: 2, shared: true });
+  for (const [buffer, growable] of [
+    [memory.buffer, false],
+    [memory.toResizableBuffer(), true],
+    [memory.toFixedLengthBuffer(), false],
+  ]) {
+    for (const value of [buffer, new Uint8Array(buffer), new DataView(buffer)]) {
+      if (growable) {
+        assert.throws(() => converters.AllowSharedBufferSource(value), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+      }
+      assert.strictEqual(converters.AllowSharedBufferSource(value, {
+        allowResizable: true,
+      }), value);
+    }
+    const view = new Uint8Array(buffer);
+    if (growable) {
+      assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+        code: 'ERR_INVALID_ARG_TYPE',
+      });
+    } else {
+      assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+    }
+  }
+});
+
 test('BufferSource rejects objects with a forged @@toStringTag', () => {
   const fake = { [Symbol.toStringTag]: 'Uint8Array' };
   assert.throws(

typings/internalBinding/util.d.ts

@@ -47,6 +47,7 @@ export interface UtilBinding {
   styleText(format: Array<string> | string, text: string): string;
   isInsideNodeModules(frameLimit?: number): boolean;
   constructSharedArrayBuffer(length?: number): SharedArrayBuffer;
+  getSharedArrayBufferGrowable(this: SharedArrayBuffer): boolean;
 
   constants: {
     kPending: 0;