fix: harden bundler overrides against prototype pollution

lib/transport.js

@@ -71,6 +71,8 @@ function flush (stream) {
   stream.flushSync()
 }
 
+const bundlerOverrides = structuredClone(Object.prototype.hasOwnProperty.call(globalThis, '__bundlerPathsOverrides') ? globalThis.__bundlerPathsOverrides : {})
+
 function transport (fullOptions) {
   const { pipeline, targets, levels, dedupe, worker = {}, caller = getCallers(), sync = false } = fullOptions
 
@@ -81,9 +83,6 @@ function transport (fullOptions) {
   // Backwards compatibility
   const callers = typeof caller === 'string' ? [caller] : caller
 
-  // This will be eventually modified by bundlers
-  const bundlerOverrides = '__bundlerPathsOverrides' in globalThis ? globalThis.__bundlerPathsOverrides : {}
-
   let target = fullOptions.target
 
   if (target && targets) {

test/transport/bundlers-override-target.test.js

@@ -0,0 +1,38 @@
+'use strict'
+
+const test = require('node:test')
+const assert = require('node:assert')
+const os = require('node:os')
+const { join } = require('node:path')
+const { readFile } = require('node:fs').promises
+
+// Set bundler overrides BEFORE loading pino
+globalThis.__bundlerPathsOverrides = {
+  foobar: join(__dirname, '..', 'fixtures', 'to-file-transport.js')
+}
+
+const { watchFileCreated, file } = require('../helper')
+const pino = require('../../pino')
+
+const { pid } = process
+const hostname = os.hostname()
+
+test('pino.transport with destination overridden by bundler', async (t) => {
+  const destination = file()
+  const transport = pino.transport({
+    target: 'foobar',
+    options: { destination }
+  })
+  t.after(transport.end.bind(transport))
+  const instance = pino(transport)
+  instance.info('hello')
+  await watchFileCreated(destination)
+  const result = JSON.parse(await readFile(destination))
+  delete result.time
+  assert.deepEqual(result, {
+    pid,
+    hostname,
+    level: 30,
+    msg: 'hello'
+  })
+})

test/transport/bundlers-override-worker-mjs.test.js

@@ -0,0 +1,42 @@
+'use strict'
+
+const test = require('node:test')
+const assert = require('node:assert')
+const os = require('node:os')
+const { join } = require('node:path')
+const { readFile } = require('node:fs').promises
+
+// Set bundler overrides BEFORE loading pino
+globalThis.__bundlerPathsOverrides = {
+  'pino-worker': join(__dirname, '..', '..', 'lib/worker.js')
+}
+
+const { watchFileCreated, file } = require('../helper')
+const pino = require('../../pino')
+
+const { pid } = process
+const hostname = os.hostname()
+
+test('pino.transport with worker destination overridden by bundler and mjs transport', async (t) => {
+  const destination = file()
+  const transport = pino.transport({
+    targets: [
+      {
+        target: join(__dirname, '..', 'fixtures', 'ts', 'to-file-transport.es2017.cjs'),
+        options: { destination }
+      }
+    ]
+  })
+  t.after(transport.end.bind(transport))
+  const instance = pino(transport)
+  instance.info('hello')
+  await watchFileCreated(destination)
+  const result = JSON.parse(await readFile(destination))
+  delete result.time
+  assert.deepEqual(result, {
+    pid,
+    hostname,
+    level: 30,
+    msg: 'hello'
+  })
+})

test/transport/bundlers-override-worker.test.js

@@ -0,0 +1,42 @@
+'use strict'
+
+const test = require('node:test')
+const assert = require('node:assert')
+const os = require('node:os')
+const { join } = require('node:path')
+const { readFile } = require('node:fs').promises
+
+// Set bundler overrides BEFORE loading pino
+globalThis.__bundlerPathsOverrides = {
+  'pino-worker': join(__dirname, '..', '..', 'lib/worker.js')
+}
+
+const { watchFileCreated, file } = require('../helper')
+const pino = require('../../pino')
+
+const { pid } = process
+const hostname = os.hostname()
+
+test('pino.transport with worker destination overridden by bundler', async (t) => {
+  const destination = file()
+  const transport = pino.transport({
+    targets: [
+      {
+        target: join(__dirname, '..', 'fixtures', 'to-file-transport.js'),
+        options: { destination }
+      }
+    ]
+  })
+  t.after(transport.end.bind(transport))
+  const instance = pino(transport)
+  instance.info('hello')
+  await watchFileCreated(destination)
+  const result = JSON.parse(await readFile(destination))
+  delete result.time
+  assert.deepEqual(result, {
+    pid,
+    hostname,
+    level: 30,
+    msg: 'hello'
+  })
+})