Node.js adds a property called `domain` to promises

Mark and I noticed that Node.js adds a property called domain to promises while running something from a REPL in SwingSet.

Mark says that domain leads to all sorts of objects whose semantics we haven’t inspected for safety. This is an authority leak. If SES can’t remove the domain property from all promises before the promise is exposed to user code, then this is a severe authority leak for SES as run on Node.js. Fortunately it seems to only be a problem when code is run from a REPL.

[edit 2020-09-15 @kriskowal]

SES will not be secure on Node.js until we have the means to disable domains. We must work with the Node.js project to reveal a command-line flag or the moral equivalent.

[kriskowal]

One of the implicit albeit soft requirements is to avoid coupling SES to any particular module system. Currently, the same source works in a browser script, CJS, and ESM, since it’s just presenting its API as mutations to the global scope. This keeps the build system small and avoids initializing anything it doesn’t need.

I’m going to present a PR with the snippet above.

[kriskowal]

Now without caveats:

if (typeof process === 'object' && process !== null) {
  // Check whether domains were initialized:
  const domainDescriptor = Object.getOwnPropertyDescriptor(process, 'domain');
  if (domainDescriptor !== undefined && domainDescriptor.get !== undefined) {
    throw new Error(`SES cannot guarantee containment if Node.js domains have been installed`);
  }
  // Prevents domains from initializing:
  Object.defineProperty(process, 'domain', {value: null, configurable: false, writable: false, enumerable: false});
}