feat: enhance security by preventing raw references in property descriptors and reflection methods

Author: frontegg-david

libs/core/src/__tests__/secure-proxy.spec.ts

@@ -632,6 +632,62 @@ describe('createSafeReflect', () => {
     // When calling undefined as a function, it throws TypeError
     expect(safeReflect?.setPrototypeOf).toBeUndefined();
   });
+
+  // Regression: createSafeReflect used to hand back the RAW native Reflect methods, whose
+  // prototype chain reaches the host Function constructor, and Reflect.get was an unrestricted
+  // reflection primitive (string-literal key evades the AST guards).
+  it('does not hand back a raw Reflect.get that can reach the Function constructor', () => {
+    const safeReflect = createSafeReflect('STANDARD') as any;
+    const get = safeReflect.get;
+    expect(typeof get).toBe('function');
+    // The returned method is behind the membrane: its constructor is blocked.
+    expect(get.constructor).toBeUndefined();
+    // Reflect.get(Reflect.get, 'constructor') must not yield a usable Function constructor.
+    expect(get(get, 'constructor')).toBeUndefined();
+  });
+
+  it('still performs reflection correctly after hardening', () => {
+    const safeReflect = createSafeReflect('STANDARD') as any;
+    const obj = { a: 1, b: 2 };
+    expect(safeReflect.get(obj, 'a')).toBe(1);
+    expect(safeReflect.has(obj, 'b')).toBe(true);
+    expect([...safeReflect.ownKeys(obj)]).toEqual(expect.arrayContaining(['a', 'b']));
+  });
+});
+
+describe('getOwnPropertyDescriptor trap must not leak raw references (review finding)', () => {
+  it('refuses an object-valued non-configurable, non-writable pinned property', () => {
+    const host: Record<string, unknown> = {};
+    Object.defineProperty(host, 'pinned', {
+      value: { leadsToHost: {} },
+      configurable: false,
+      writable: false,
+      enumerable: true,
+    });
+    const proxy = createSecureProxy(host);
+    expect(() => Object.getOwnPropertyDescriptor(proxy, 'pinned')).toThrow(/blocked|cannot be exposed/i);
+  });
+
+  it('still reports a primitive-valued pinned property via its descriptor', () => {
+    const host: Record<string, unknown> = {};
+    Object.defineProperty(host, 'VERSION', {
+      value: 7,
+      configurable: false,
+      writable: false,
+      enumerable: true,
+    });
+    const proxy = createSecureProxy(host);
+    expect(Object.getOwnPropertyDescriptor(proxy, 'VERSION')?.value).toBe(7);
+  });
+
+  it('wraps a configurable object value so its descriptor cannot leak a raw reference', () => {
+    const obj = { child: { nested: 1 } };
+    const proxy = createSecureProxy(obj) as any;
+    const descriptor = Object.getOwnPropertyDescriptor(proxy, 'child');
+    // The descriptor value is itself a secure proxy: constructor is blocked.
+    expect(descriptor?.value.constructor).toBeUndefined();
+    expect(descriptor?.value.nested).toBe(1);
+  });
 });
 
 describe('BLOCKED_PROPERTY_CATEGORIES', () => {

libs/core/src/double-vm/parent-vm-bootstrap.ts

@@ -984,7 +984,23 @@ ${stackTraceHardeningCode}
         var propName = String(property);
         var descriptor = Reflect.getOwnPropertyDescriptor(target, property);
 
-        // Must return actual descriptor for non-configurable properties (proxy invariant)
+        // Mirror the get trap's host-owned pinned-value refusal: a non-configurable, non-writable
+        // data property must be reported with its exact value (proxy invariant), so on a HOST-owned
+        // value an object/function would cross the barrier unwrapped via descriptor.value and its
+        // prototype chain reaches the host Function constructor. Deny the read instead (throwing
+        // satisfies the invariant); primitives stay safe to report.
+        if (host && descriptor && !descriptor.configurable && descriptor.writable === false && 'value' in descriptor) {
+          var exactValue = descriptor.value;
+          if (exactValue !== null && (typeof exactValue === 'object' || typeof exactValue === 'function')) {
+            throw createSafeError(
+              "Security violation: Access to property descriptor for '" + propName + "' is blocked. " +
+              "This property cannot be exposed without breaking the sandbox barrier."
+            );
+          }
+          return descriptor;
+        }
+
+        // Must return actual descriptor for other non-configurable properties (proxy invariant)
         if (descriptor && !descriptor.configurable) {
           return descriptor;
         }
@@ -999,6 +1015,18 @@ ${stackTraceHardeningCode}
           }
           return undefined;
         }
+
+        // Wrap object/function values so a descriptor read cannot hand back a raw reference that
+        // the get trap would otherwise have proxied.
+        if (descriptor && 'value' in descriptor) {
+          var value = descriptor.value;
+          if (value !== null && (typeof value === 'object' || typeof value === 'function')) {
+            var wrapped = {};
+            for (var dk in descriptor) { if (Object.prototype.hasOwnProperty.call(descriptor, dk)) wrapped[dk] = descriptor[dk]; }
+            wrapped.value = createSecureProxy(value, depth + 1, host);
+            return wrapped;
+          }
+        }
         return descriptor;
       },
       ownKeys: function(target) {

libs/core/src/secure-proxy.ts

@@ -219,7 +219,7 @@ export function createSafeReflect(securityLevel: SecurityLevel): typeof Reflect
 
       // Wrap Reflect.construct to block Function constructors
       if (typeof value === 'function' && prop === 'construct') {
-        return function (ctorTarget: unknown, args: unknown[], newTarget?: unknown) {
+        const safeConstruct = function (ctorTarget: unknown, args: unknown[], newTarget?: unknown) {
           // Block Function, AsyncFunction, GeneratorFunction, AsyncGeneratorFunction constructors
           // Intentional empty functions to obtain constructor references
           // eslint-disable-next-line @typescript-eslint/no-empty-function
@@ -243,6 +243,17 @@ export function createSafeReflect(securityLevel: SecurityLevel): typeof Reflect
             newTarget as new (...args: unknown[]) => unknown,
           );
         };
+        // Wrap so the returned function cannot itself be walked to the host Function constructor.
+        return createSecureProxy(safeConstruct);
+      }
+
+      // SECURITY: never hand back the RAW native Reflect methods. Each is a host-realm function
+      // whose prototype chain reaches the host Function constructor, and Reflect.get /
+      // Reflect.getOwnPropertyDescriptor are reflection primitives whose STRING-LITERAL key
+      // argument bypasses the AST computed-key guard. Wrapping in a secure proxy blocks
+      // `.constructor` on the method and keeps every result behind the membrane.
+      if (typeof value === 'function') {
+        return createSecureProxy(value);
       }
 
       return value;
@@ -663,7 +674,23 @@ export function createSecureProxy<T extends object>(target: T, options: SecurePr
         const propName = typeof property === 'symbol' ? property.toString() : property;
         const descriptor = Reflect.getOwnPropertyDescriptor(target, property);
 
-        // Must return actual descriptor for non-configurable properties (proxy invariant)
+        // Mirror the get trap: a non-configurable, non-writable data property must be reported
+        // with its exact value (proxy invariant), so an object/function value cannot be wrapped
+        // or hidden and would cross the barrier unwrapped via `descriptor.value`. Deny the read
+        // instead (throwing satisfies the invariant); primitives are inert and safe to report.
+        if (descriptor && !descriptor.configurable && descriptor.writable === false && 'value' in descriptor) {
+          const exactValue: unknown = descriptor.value;
+          if (exactValue !== null && (typeof exactValue === 'object' || typeof exactValue === 'function')) {
+            throw createSafeError(
+              `Security violation: Access to property descriptor for '${String(propName)}' is blocked. ` +
+                `This property cannot be exposed without breaking the sandbox barrier.`,
+              'SecurityError',
+            );
+          }
+          return descriptor;
+        }
+
+        // Must return actual descriptor for other non-configurable properties (proxy invariant)
         if (descriptor && !descriptor.configurable) {
           return descriptor;
         }
@@ -683,6 +710,15 @@ export function createSecureProxy<T extends object>(target: T, options: SecurePr
           return undefined;
         }
 
+        // Wrap object/function values so a descriptor read cannot hand back a raw reference that
+        // the get trap would have proxied (a configurable property's value may be safely wrapped).
+        if (descriptor && 'value' in descriptor) {
+          const value: unknown = descriptor.value;
+          if (value !== null && (typeof value === 'object' || typeof value === 'function')) {
+            return { ...descriptor, value: proxyWithDepth(value as object, depth + 1) };
+          }
+        }
+
         return descriptor;
       },