util: protect against monkeypatched Object prototype for inspect()

Prevent affects of monkeypatching (for example) Object.keys() when
calling util.inspect().

PR-URL: https://github.com/nodejs/node/pull/25953
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>

1 files changed, 8 insertions, 7 deletions

diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 0f81ab5d02..94d6ef8706 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -63,6 +63,11 @@ const {
   isBigUint64Array
 } = require('internal/util/types');
 
+const assert = require('internal/assert');
+
+// Avoid monkey-patched built-ins.
+const { Object } = primordials;
+
 const ReflectApply = Reflect.apply;
 
 // This function is borrowed from the function with the same name on V8 Extras'
@@ -383,13 +388,9 @@ function getKeys(value, showHidden) {
     try {
       keys = Object.keys(value);
     } catch (err) {
-      if (isNativeError(err) &&
-          err.name === 'ReferenceError' &&
-          isModuleNamespaceObject(value)) {
-        keys = Object.getOwnPropertyNames(value);
-      } else {
-        throw err;
-      }
+      assert(isNativeError(err) && err.name === 'ReferenceError' &&
+             isModuleNamespaceObject(value));
+      keys = Object.getOwnPropertyNames(value);
     }
     if (symbols.length !== 0) {
       keys.push(...symbols.filter((key) => propertyIsEnumerable(value, key)));