fix: guard worker filename from proto pollution

src/common.ts

@@ -111,6 +111,12 @@ export function markMovable(value: object): void {
   })
 }
 
+// Copy own properties onto a prototype-less object, so that options are never
+// resolved through a polluted prototype chain.
+export function withNullPrototype<T extends object>(source: T): T {
+  return Object.assign(Object.create(null), source)
+}
+
 export interface Transferable {
   readonly [kTransferable]: object
   readonly [kValue]: object

src/index.ts

@@ -28,6 +28,7 @@ import {
   isTransferable,
   markMovable,
   isMovable,
+  withNullPrototype,
   kTransferable,
   kValue,
   type TinypoolData,
@@ -656,12 +657,12 @@ class ThreadPool {
       ? maybeFileURLToPath(options.filename)
       : null
 
-    this.options = Object.assign(
-      Object.create(null),
-      kDefaultOptions,
-      options,
-      { filename, maxQueue: 0 }
-    )
+    this.options = withNullPrototype({
+      ...kDefaultOptions,
+      ...options,
+      filename,
+      maxQueue: 0,
+    })
 
     // The >= and <= could be > and < but this way we get 100 % coverage 🙃
     if (
@@ -1108,7 +1109,8 @@ class ThreadPool {
     await Promise.all(exitEvents)
   }
 
-  async recycleWorkers(options: Pick<Options, 'runtime'> = {}) {
+  async recycleWorkers(_options: Pick<Options, 'runtime'> = {}) {
+    const options = withNullPrototype(_options)
     const runtimeChanged =
       options?.runtime && options.runtime !== this.options.runtime
 
@@ -1148,7 +1150,9 @@ class ThreadPool {
 class Tinypool extends EventEmitterAsyncResource {
   #pool: ThreadPool
 
-  constructor(options: Options = {}) {
+  constructor(_options: Options = {}) {
+    const options = withNullPrototype(_options)
+
     // convert fractional option values to int
     if (
       options.minThreads !== undefined &&
@@ -1187,7 +1191,8 @@ class Tinypool extends EventEmitterAsyncResource {
   }
 
   run(task: any, options: RunOptions = kDefaultRunOptions) {
-    const { transferList, filename, name, signal, runtime, channel } = options
+    const { transferList, filename, name, signal, runtime, channel } =
+      withNullPrototype(options)
 
     return this.#pool.runTask(task, {
       transferList,

test/options.test.ts

@@ -73,6 +73,28 @@ test('ignores worker options from prototype', async () => {
   expect(result).toBe(42)
 })
 
+test('ignores worker filename from prototype', async () => {
+  {
+    const failsWhenLoaded = resolve(__dirname, 'fixtures/fails-when-loaded.mjs')
+
+    onTestFinished(() => {
+      // @ts-expect-error -- intentional
+      delete Object.prototype.filename
+    })
+
+    // @ts-expect-error -- intentional
+    Object.prototype.filename = failsWhenLoaded
+  }
+
+  const worker = new Tinypool({
+    filename: resolve(__dirname, 'fixtures/eval.js'),
+  })
+  const result = await worker.run('42', {
+    signal: new AbortController().signal,
+  })
+  expect(result).toBe(42)
+})
+
 vi.mock(import('node:os'), async (importOriginal) => {
   const original = await importOriginal()
   return {