feat: enhance security by blocking dangerous static destructuring keys to prevent host RCE vulnerabilities (#78)

* feat: enhance security by blocking dangerous static destructuring keys to prevent host RCE vulnerabilities (GHSA-3279)

* feat: enhance security by blocking computed destructuring and dangerous static keys to prevent property name attacks

* feat: enhance security by pinning Reflect methods to prevent shared-realm tampering

* feat: enhance security by preventing mutations to the Reflect global in the sandbox

* feat: enhance security by preventing mutations to the Reflect global in the sandbox

Author: frontegg-david

libs/ast/src/__tests__/no-computed-destructuring.spec.ts

@@ -107,6 +107,47 @@ describe('NoComputedDestructuringRule', () => {
     });
   });
 
+  describe('Static Dangerous Keys (GHSA-3279)', () => {
+    const dangerous = [
+      'constructor',
+      'prototype',
+      '__proto__',
+      '__defineGetter__',
+      '__defineSetter__',
+      '__lookupGetter__',
+      '__lookupSetter__',
+    ];
+
+    for (const key of dangerous) {
+      it(`blocks identifier key { ${key}: x }`, async () => {
+        const validator = new JSAstValidator([new NoComputedDestructuringRule()]);
+        const result = await validator.validate(`const { ${key}: x } = obj;`);
+        expect(result.valid).toBe(false);
+        expect(result.issues[0].code).toBe('NO_DANGEROUS_DESTRUCTURING');
+      });
+
+      it(`blocks string-literal key { "${key}": x }`, async () => {
+        const validator = new JSAstValidator([new NoComputedDestructuringRule()]);
+        const result = await validator.validate(`const { "${key}": x } = obj;`);
+        expect(result.valid).toBe(false);
+        expect(result.issues[0].code).toBe('NO_DANGEROUS_DESTRUCTURING');
+      });
+    }
+
+    it('blocks a dangerous key nested inside a valid pattern', async () => {
+      const validator = new JSAstValidator([new NoComputedDestructuringRule()]);
+      const result = await validator.validate(`const { user: { "constructor": c } } = obj;`);
+      expect(result.valid).toBe(false);
+      expect(result.issues[0].code).toBe('NO_DANGEROUS_DESTRUCTURING');
+    });
+
+    it('does not flag a benign key that merely contains a dangerous substring', async () => {
+      const validator = new JSAstValidator([new NoComputedDestructuringRule()]);
+      const result = await validator.validate(`const { constructorName, prototypeId } = obj;`);
+      expect(result.valid).toBe(true);
+    });
+  });
+
   describe('Valid Patterns (Should Allow)', () => {
     it('should allow static property names', async () => {
       const validator = new JSAstValidator([new NoComputedDestructuringRule()]);

libs/ast/src/rules/no-computed-destructuring.rule.ts

@@ -2,6 +2,23 @@ import type { ValidationRule, ValidationContext } from '../interfaces';
 import { ValidationSeverity } from '../interfaces';
 import * as walk from 'acorn-walk';
 
+/**
+ * Property keys that must never be read through destructuring: their prototype chain reaches host
+ * intrinsics (constructor -> Function). Blocking them statically closes GHSA-3279, where
+ * `const { "constructor": C } = {}` and `const { prototype: p } = callTool` slipped past the
+ * computed-key guard because the key is a static Identifier/Literal. Mirrors the runtime membrane
+ * and interpreter blocked-key sets.
+ */
+const DANGEROUS_DESTRUCTURING_KEYS = new Set([
+  'constructor',
+  'prototype',
+  '__proto__',
+  '__defineGetter__',
+  '__defineSetter__',
+  '__lookupGetter__',
+  '__lookupSetter__',
+]);
+
 /**
  * Configuration options for NoComputedDestructuringRule
  */
@@ -52,7 +69,8 @@ export interface NoComputedDestructuringOptions {
 export class NoComputedDestructuringRule implements ValidationRule {
   readonly name = 'no-computed-destructuring';
   readonly description =
-    'Blocks computed property names in destructuring patterns to prevent runtime property name attacks';
+    'Blocks computed property names and dangerous static keys (constructor, prototype, __proto__, ...) ' +
+    'in destructuring patterns to prevent property name attacks';
   readonly defaultSeverity = ValidationSeverity.ERROR;
   readonly enabledByDefault = true;
 
@@ -71,8 +89,10 @@ export class NoComputedDestructuringRule implements ValidationRule {
         if (!node.properties) return;
 
         for (const prop of node.properties) {
-          // Check for computed property: { [expr]: binding }
-          if (prop.type === 'Property' && prop.computed === true) {
+          if (prop.type !== 'Property') continue;
+
+          // Computed key: { [expr]: binding } — the name is unknowable at analysis time.
+          if (prop.computed === true) {
             const keyDescription = this.describeKey(prop.key);
 
             report({
@@ -82,24 +102,32 @@ export class NoComputedDestructuringRule implements ValidationRule {
                 `Computed property names in destructuring are not allowed: { [${keyDescription}]: ... }. ` +
                   `This pattern can be used to bypass security checks by constructing dangerous property names at runtime. ` +
                   `Use static property names instead.`,
-              location: prop.key?.loc
-                ? {
-                    line: prop.key.loc.start.line,
-                    column: prop.key.loc.start.column,
-                    endLine: prop.key.loc.end.line,
-                    endColumn: prop.key.loc.end.column,
-                  }
-                : node.loc
-                  ? {
-                      line: node.loc.start.line,
-                      column: node.loc.start.column,
-                    }
-                  : undefined,
+              location: this.keyLocation(prop, node),
               data: {
                 keyType: prop.key?.type,
                 keyDescription,
               },
             });
+            continue;
+          }
+
+          // Static key: { "constructor": binding } / { constructor: binding }. These are not
+          // computed, so the guard above never fired — block dangerous names explicitly.
+          const staticName = this.staticKeyName(prop.key);
+          if (staticName !== undefined && DANGEROUS_DESTRUCTURING_KEYS.has(staticName)) {
+            report({
+              code: 'NO_DANGEROUS_DESTRUCTURING',
+              message:
+                this.customMessage ||
+                `Destructuring the '${staticName}' property is not allowed: { ${this.describeKey(prop.key)}: ... }. ` +
+                  `This property's prototype chain can reach the Function constructor for sandbox escape. ` +
+                  `Remove the '${staticName}' binding.`,
+              location: this.keyLocation(prop, node),
+              data: {
+                keyType: prop.key?.type,
+                key: staticName,
+              },
+            });
           }
         }
       },
@@ -110,6 +138,37 @@ export class NoComputedDestructuringRule implements ValidationRule {
     });
   }
 
+  /**
+   * Resolve the name of a NON-computed destructuring key (Identifier or Literal), or undefined
+   * when it has no statically-known string name.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- acorn doesn't export specific node types
+  private staticKeyName(key: any): string | undefined {
+    if (!key) return undefined;
+    if (key.type === 'Identifier') return key.name;
+    if (key.type === 'Literal') return typeof key.value === 'string' ? key.value : String(key.value);
+    return undefined;
+  }
+
+  /**
+   * Build the issue location from the offending key, falling back to the pattern node.
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- acorn doesn't export specific node types
+  private keyLocation(prop: any, node: any) {
+    if (prop.key?.loc) {
+      return {
+        line: prop.key.loc.start.line,
+        column: prop.key.loc.start.column,
+        endLine: prop.key.loc.end.line,
+        endColumn: prop.key.loc.end.column,
+      };
+    }
+    if (node.loc) {
+      return { line: node.loc.start.line, column: node.loc.start.column };
+    }
+    return undefined;
+  }
+
   /**
    * Generate a human-readable description of the computed key
    */