worker: protect against user mutating well-known prototypes

PR-URL: #49270
Fixes: #49259
Reviewed-By: Ben Noordhuis <[email protected]>
Reviewed-By: Benjamin Gruenbaum <[email protected]>
Reviewed-By: Matthew Aitken <[email protected]>
Reviewed-By: Yagiz Nizipli <[email protected]>

Author: aduh95

lib/internal/worker/io.js

@@ -22,6 +22,7 @@ const {
 const {
   kEmptyObject,
   kEnumerableProperty,
+  setOwnProperty,
 } = require('internal/util');
 
 const {
@@ -302,15 +303,15 @@ function setupPortReferencing(port, eventEmitter, eventName) {
     if (name === eventName) removeListener(eventEmitter.listenerCount(name));
   });
   const origNewListener = eventEmitter[kNewListener];
-  eventEmitter[kNewListener] = function(size, type, ...args) {
+  setOwnProperty(eventEmitter, kNewListener, function(size, type, ...args) {
     if (type === eventName) newListener(size - 1);
     return ReflectApply(origNewListener, this, arguments);
-  };
+  });
   const origRemoveListener = eventEmitter[kRemoveListener];
-  eventEmitter[kRemoveListener] = function(size, type, ...args) {
+  setOwnProperty(eventEmitter, kRemoveListener, function(size, type, ...args) {
     if (type === eventName) removeListener(size);
     return ReflectApply(origRemoveListener, this, arguments);
-  };
+  });
 
   function newListener(size) {
     if (size === 0) {

test/parallel/test-worker-message-channel.js

@@ -3,6 +3,9 @@ const common = require('../common');
 const assert = require('assert');
 const { MessageChannel, MessagePort, Worker } = require('worker_threads');
 
+// Asserts that freezing the EventTarget prototype does not make the internal throw.
+Object.freeze(EventTarget.prototype);
+
 {
   const channel = new MessageChannel();