fix(fetch): prevent Illegal invocations of the FileLike class (nodejs…

…#1207)
metcoder95 · Dec 26, 2022 · 2168162 · 2168162
1 parent c6e6c28
commit 2168162
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 2 deletions.
diff --git a/lib/fetch/file.js b/lib/fetch/file.js
@@ -124,26 +124,50 @@ class FileLike {
   }
 
   stream (...args) {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.stream(...args)
   }
 
   arrayBuffer (...args) {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.arrayBuffer(...args)
   }
 
   slice (...args) {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.slice(...args)
   }
 
   text (...args) {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.text(...args)
   }
 
   get size () {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.size
   }
 
   get type () {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return this[kState].blobLike.type
   }
 
@@ -164,6 +188,10 @@ class FileLike {
   }
 
   get [Symbol.toStringTag] () {
+    if (!(this instanceof FileLike)) {
+      throw new TypeError('Illegal invocation')
+    }
+
     return 'File'
   }
 }

diff --git a/test/fetch/client-fetch.js b/test/fetch/client-fetch.js
@@ -6,10 +6,10 @@ const { test } = require('tap')
 const { createServer } = require('http')
 const { ReadableStream } = require('stream/web')
 const { Blob } = require('buffer')
-const { fetch, Response, Request, FormData, File } = require('../..')
+const { fetch, Response, Request, FormData, File, FileLike } = require('../..')
 
 test('args validation', (t) => {
-  t.plan(3)
+  t.plan(12)
 
   t.throws(() => {
     File.prototype.name.call(null)
@@ -20,6 +20,34 @@ test('args validation', (t) => {
   t.throws(() => {
     File.prototype[Symbol.toStringTag].call(null)
   }, TypeError)
+
+  t.throws(() => {
+    FileLike.prototype.stream.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.arrayBuffer.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.slice.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.text.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.size.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.type.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.name.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype.lastModified.call(null)
+  }, TypeError)
+  t.throws(() => {
+    FileLike.prototype[Symbol.toStringTag].call(null)
+  }, TypeError)
 })
 
 test('return value of File.lastModified', (t) => {