compat: chalk doesn't work because of missing __proto__

[bartlomieju]

index.js

const chalk = require('chalk')

const test = {
    name: "foo",
};
const p = "*";
console.log(chalk.bold);
const pref = chalk.bold.dim(test.name + p + ' ')
console.log("pref", pref);

package.json

{
  "name": "test_chalk",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "chalk": "^3.0.0"
  }
}

$ node index.js
[Function: builder] {
  _generator: [Function (anonymous)] Chalk {
    constructor: [Function (anonymous)],
    Instance: [class ChalkClass],
    supportsColor: { level: 3, hasBasic: true, has256: true, has16m: true },
    stderr: [Function (anonymous)] Chalk {
      constructor: [Function (anonymous)],
      Instance: [class ChalkClass],
      supportsColor: [Object]
    },
    Level: {
      '0': 'None',
      '1': 'Basic',
      '2': 'Ansi256',
      '3': 'TrueColor',
      None: 0,
      Basic: 1,
      Ansi256: 2,
      TrueColor: 3
    }
  },
  _styler: {
    open: '\x1B[1m',
    close: '\x1B[22m',
    openAll: '\x1B[1m',
    closeAll: '\x1B[22m',
    parent: undefined
  },
  _isEmpty: undefined
}
pref foo*

$ deno run --unstable --compat --no-check index.js
[Function: builder] {
  __proto__: [Function] { level: [Getter/Setter] },
  _generator: [Chalk] {
    constructor: [Function],
    Instance: [Function: ChalkClass],
    supportsColor: { level: 3, hasBasic: true, has256: true, has16m: true },
    stderr: [Chalk] {
      constructor: [Function],
      Instance: [Function: ChalkClass],
      supportsColor: { level: 3, hasBasic: true, has256: true, has16m: true }
    },
    Level: {
      "0": "None",
      "1": "Basic",
      "2": "Ansi256",
      "3": "TrueColor",
      None: 0,
      Basic: 1,
      Ansi256: 2,
      TrueColor: 3
    }
  },
  _styler: {
    open: "\x1b[1m",
    close: "\x1b[22m",
    openAll: "\x1b[1m",
    closeAll: "\x1b[22m",
    parent: undefined
  },
  _isEmpty: undefined
}
error: Uncaught (in promise) TypeError: chalk.bold.dim is not a function
const pref = chalk.bold.dim(test.name + p + ' ')
                        ^
    at Object.<anonymous> (file:///Users/biwanczuk/dev/test_chalk/index.js:8:25)
    at Module._compile (https://deno.land/std@0.120.0/node/module.ts:252:36)
    at Object.Module._extensions..js (https://deno.land/std@0.120.0/node/module.ts:1276:10)
    at Module.load (https://deno.land/std@0.120.0/node/module.ts:231:33)
    at Function._load (https://deno.land/std@0.120.0/node/module.ts:540:14)
    at loadCjsModule ([deno:cli/compat/mod.rs:116:30]:3:22)

[bartlomieju]

This seems to stem from the fact that Deno doesn't support __proto__ from Annex B. @kt3k @kitsonk any ideas how we could handle that?

[bartlomieju]

Caused by this:

deno/runtime/js/99_main.js

Lines 2 to 6 in bd53567

	// Removes the `__proto__` for security reasons. This intentionally makes
	// Deno non compliant with ECMA-262 Annex B.2.2.1
	//
	"use strict";
	delete Object.prototype.__proto__;

This is a blocker for running tap in Deno's compat mode.

chalk has over 130mm weekly downloads (https://www.npmjs.com/package/chalk) it seems like something we need to address.

[kitsonk]

The usage boils down to this: chalk/chalk#32 (comment)

Of course this was last looked at seriously back in 2014. sindresorhus says in chalk/chalk#124 that they are willing to accept a PR as long as it doesn't impact performance. And that was in 2016. Runtimes have moved on quite a bit, and even back in 2014, the comment of Object.setPrototypeOf() was flouted. That of course wasn't really a consideration and Object.setPrototypeOf() didn't really exist at that point, and the performance certainly wasn't optimized. As far as I can tell, no one has seriously looked at it in 8 years.

Node.js libraries are littered with __proto__ exploits the create security advisories. It is one of the most common attack vectors. We have eliminated it by deleting a deprecated and optional property from the runtime.

So there are two options:

• do the performance research and float a patch to do Object.setPrototypeOf(), which really is the proper and best way.
• create a shim for chalk or the compat mode that is a getter named __proto__ on Object.prototype that calls Object.setPrototypeOf() with the value passed.

But don't decrease the security of the whole platform for some outdated code from 2014 that was using a "bad" and deprecated API back in 2014. I can understand that reasoning back in 2014, but things move on.

[lucacasonato]

Both version 4.0 and 5.0 of chalk do not use __proto__. The usage was removed in chalk/chalk@63469d3.

[lucacasonato]

See chalk/chalk#387. It actually mentions Deno disabling __proto__ :-)

[kitsonk]

🤦 so we just need to upgrade dependencies then‽

[andreubotella]

• create a shim for chalk or the compat mode that is a getter named __proto__ on Object.prototype that calls Object.setPrototypeOf() with the value passed.

Other than some odd behavior in object literals, it seems like __proto__ really is a getter/setter that calls the internal equivalents of Object.getProperty and Object.setProperty. So you'd win nothing by defining it explicitly.

[bartlomieju]

Okay, it seems I made a lot of buzz for no good reason. treport is using an outdated version of chalk (^3.0.0)

[kitsonk]

Other than some odd behavior in object literals, it seems like __proto__ really is a getter/setter that calls the internal equivalents of Object.getProperty and Object.setProperty. So you'd win nothing by defining it explicitly.

Other than only doing it in certain situations, instead of re-introducing it for everything, but it seems like it is an irrelevant issue.