Remove Object.prototype.__proto__ (#4341)

1 files changed, 6 insertions, 0 deletions

diff --git a/cli/js/main.ts b/cli/js/main.ts
index fbebfefe4..881d3ad4a 100644
--- a/cli/js/main.ts
+++ b/cli/js/main.ts
@@ -2,6 +2,12 @@
 import { bootstrapMainRuntime } from "./runtime_main.ts";
 import { bootstrapWorkerRuntime } from "./runtime_worker.ts";
 
+// Removes the `__proto__` for security reasons.  This intentionally makes
+// Deno non compliant with ECMA-262 Annex B.2.2.1
+//
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+delete (Object.prototype as any).__proto__;
+
 Object.defineProperties(globalThis, {
   bootstrapMainRuntime: {
     value: bootstrapMainRuntime,