fix: Resilient to prototype pollution of Intl (#517)

sinonjs · Dec 9, 2024 · 656733c · 656733c
1 parent ff8d907
commit 656733c
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 2 deletions.
diff --git a/src/fake-timers-src.js b/src/fake-timers-src.js
@@ -206,7 +206,12 @@ function withGlobal(_global) {
     }
 
     const NativeDate = _global.Date;
-    const NativeIntl = _global.Intl;
+    const NativeIntl = isPresent.Intl
+        ? Object.defineProperties(
+              Object.create(null),
+              Object.getOwnPropertyDescriptors(_global.Intl),
+          )
+        : undefined;
     let uniqueTimerId = idCounterStart;
 
     if (NativeDate === undefined) {
@@ -1107,7 +1112,7 @@ function withGlobal(_global) {
     }
 
     if (isPresent.Intl) {
-        timers.Intl = _global.Intl;
+        timers.Intl = NativeIntl;
     }
 
     const originalSetTimeout = _global.setImmediate || _global.setTimeout;

diff --git a/test/issue-516-test.js b/test/issue-516-test.js
@@ -0,0 +1,20 @@
+"use strict";
+
+const { FakeTimers } = require("./helpers/setup-tests");
+
+describe("issue #516 - not resilient to changes on Intl", function () {
+    it("should successfully install the timer", function () {
+        const originalIntlProperties = Object.getOwnPropertyDescriptors(
+            global.Intl,
+        );
+        for (const key of Object.keys(originalIntlProperties)) {
+            delete global.Intl[key];
+        }
+        try {
+            const clock = FakeTimers.createClock();
+            clock.tick(16);
+        } finally {
+            Object.defineProperties(global.Intl, originalIntlProperties);
+        }
+    });
+});