Harden tool dispatch against inherited properties

edge/test/worker.test.mjs

@@ -210,7 +210,11 @@ test("root storefront serves the honest Guard founding offer for exact GET and H
   assert.match(html, /No payment is due with this application/);
   assert.match(html, /not posted publicly/);
   assert.doesNotMatch(html, /email notification|we(?:'|’)ll notify/i);
-  const inlineScript = html.match(/<script>([\s\S]*?)<\/script>/)?.[1];
+  const scriptStart = html.indexOf("<script>");
+  const scriptEnd = html.indexOf("</script>", scriptStart);
+  const inlineScript = scriptStart === -1 || scriptEnd === -1
+    ? undefined
+    : html.slice(scriptStart + "<script>".length, scriptEnd);
   assert.ok(inlineScript);
   const scriptHash = createHash("sha256").update(inlineScript).digest("base64");
   assert.ok(contentSecurityPolicy.includes(`script-src 'sha256-${scriptHash}'`));

src/tools.mjs

@@ -662,8 +662,9 @@ const implementations = {
 };
 
 export function executeTool(name, input) {
+  if (!Object.hasOwn(implementations, name)) throw new ServiceError(404, "unknown_tool", `Unknown GoldKey tool: ${name}`);
   const implementation = implementations[name];
-  if (!implementation) throw new ServiceError(404, "unknown_tool", `Unknown GoldKey tool: ${name}`);
+  if (typeof implementation !== "function") throw new ServiceError(404, "unknown_tool", `Unknown GoldKey tool: ${name}`);
   const result = implementation(input);
   const inputHash = toolInputHash(name, input);
   return { tool: name, tool_version: VERSION, input_sha256: inputHash, result };

test/tools.test.mjs

@@ -2,6 +2,16 @@ import assert from "node:assert/strict";
 import test from "node:test";
 import { executeTool } from "../src/tools.mjs";
 
+test("tool dispatch rejects inherited Object prototype names", () => {
+  for (const name of ["constructor", "toString", "valueOf", "hasOwnProperty", "__defineGetter__", "__proto__"]) {
+    assert.throws(
+      () => executeTool(name, {}),
+      (error) => error.status === 404 && error.code === "unknown_tool",
+      name,
+    );
+  }
+});
+
 test("canonicalization is stable across object key order", () => {
   const left = executeTool("json.canonicalize", { value: { z: 1, a: [true, null] } });
   const right = executeTool("json.canonicalize", { value: { a: [true, null], z: 1 } });