fix(cli/rt): make some web API constructors illegal at runtime (#7468)

1 files changed, 21 insertions, 5 deletions

diff --git a/cli/rt/40_permissions.js b/cli/rt/40_permissions.js
index 983d0895a..982e4c842 100644
--- a/cli/rt/40_permissions.js
+++ b/cli/rt/40_permissions.js
@@ -2,6 +2,7 @@
 
 ((window) => {
   const core = window.Deno.core;
+  const { illegalConstructorKey } = window.__bootstrap.webUtil;
 
   function opQuery(desc) {
     return core.jsonOpSync("op_query_permission", desc).state;
@@ -16,30 +17,45 @@
   }
 
   class PermissionStatus {
-    constructor(state) {
+    constructor(state, key) {
+      if (key != illegalConstructorKey) {
+        throw new TypeError("Illegal constructor.");
+      }
       this.state = state;
     }
     // TODO(kt3k): implement onchange handler
   }
 
   class Permissions {
+    constructor(key) {
+      if (key != illegalConstructorKey) {
+        throw new TypeError("Illegal constructor.");
+      }
+    }
+
     query(desc) {
       const state = opQuery(desc);
-      return Promise.resolve(new PermissionStatus(state));
+      return Promise.resolve(
+        new PermissionStatus(state, illegalConstructorKey),
+      );
     }
 
     revoke(desc) {
       const state = opRevoke(desc);
-      return Promise.resolve(new PermissionStatus(state));
+      return Promise.resolve(
+        new PermissionStatus(state, illegalConstructorKey),
+      );
     }
 
     request(desc) {
       const state = opRequest(desc);
-      return Promise.resolve(new PermissionStatus(state));
+      return Promise.resolve(
+        new PermissionStatus(state, illegalConstructorKey),
+      );
     }
   }
 
-  const permissions = new Permissions();
+  const permissions = new Permissions(illegalConstructorKey);
 
   window.__bootstrap.permissions = {
     permissions,