diff --git a/packages/ses/src/permits.js b/packages/ses/src/permits.js index 557e64f8b4..6fd26ae7a7 100644 --- a/packages/ses/src/permits.js +++ b/packages/ses/src/permits.js @@ -366,6 +366,10 @@ const accessor = { set: fn, }; +const nullDesc = { + value: null, +} + // eslint-disable-next-line func-names const strict = function () { 'use strict'; @@ -2194,6 +2198,8 @@ export const permitted = { // Properties of the TextEncoder Constructor '[[Proto]]': '%FunctionPrototype%', prototype: '%TextEncoderPrototype%', + arguments: nullDesc, + caller: nullDesc, }, '%TextEncoderPrototype%': { @@ -2211,6 +2217,8 @@ export const permitted = { // Properties of the TextDecoder Constructor '[[Proto]]': '%FunctionPrototype%', prototype: '%TextDecoderPrototype%', + arguments: nullDesc, + caller: nullDesc, }, '%TextDecoderPrototype%': { diff --git a/packages/ses/test/permits-chrome-126.test.js b/packages/ses/test/permits-chrome-126.test.js new file mode 100644 index 0000000000..75fd40aab4 --- /dev/null +++ b/packages/ses/test/permits-chrome-126.test.js @@ -0,0 +1,21 @@ +// @ts-nocheck +import test from 'ava'; +import 'ses'; + +test('TextEncoder arguments and caller properties as seen in chrome 126 are permitted', t => { + // Reproduce the broken behavior in Chrome 126 + const descr = { + value: null, + writable: false, + enumerable: false, + configurable: false, + }; + Object.defineProperty(globalThis.TextEncoder, 'caller', descr); + Object.defineProperty(globalThis.TextEncoder, 'arguments', descr); + Object.defineProperty(globalThis.TextDecoder, 'caller', descr); + Object.defineProperty(globalThis.TextDecoder, 'arguments', descr); + + t.notThrows(() => { + lockdown(); + }); +});