3 files changed, 42 insertions, 0 deletions
diff --git a/cli/tests/unit/console_test.ts b/cli/tests/unit/console_test.ts
index 239a8bf26..2b7426b99 100644
--- a/cli/tests/unit/console_test.ts
+++ b/cli/tests/unit/console_test.ts
@@ -2138,6 +2138,18 @@ Deno.test(async function inspectAggregateError() {
   }
 });
 
+Deno.test(function inspectWithPrototypePollution() {
+  const originalExec = RegExp.prototype.exec;
+  try {
+    RegExp.prototype.exec = () => {
+      throw Error();
+    };
+    Deno.inspect("foo");
+  } finally {
+    RegExp.prototype.exec = originalExec;
+  }
+});
+
 Deno.test(function inspectorMethods() {
   console.timeStamp("test");
   console.profile("test");
diff --git a/cli/tests/unit/headers_test.ts b/cli/tests/unit/headers_test.ts
index fda4e81d9..295f03071 100644
--- a/cli/tests/unit/headers_test.ts
+++ b/cli/tests/unit/headers_test.ts
@@ -325,6 +325,21 @@ Deno.test(function headersInitMultiple() {
   ]);
 });
 
+Deno.test(function headerInitWithPrototypePollution() {
+  const originalExec = RegExp.prototype.exec;
+  try {
+    RegExp.prototype.exec = () => {
+      throw Error();
+    };
+    new Headers([
+      ["X-Deno", "foo"],
+      ["X-Deno", "bar"],
+    ]);
+  } finally {
+    RegExp.prototype.exec = originalExec;
+  }
+});
+
 Deno.test(function headersAppendMultiple() {
   const headers = new Headers([
     ["Set-Cookie", "foo=bar"],
diff --git a/cli/tests/unit/urlpattern_test.ts b/cli/tests/unit/urlpattern_test.ts
index 1ec64b2fe..9bed09235 100644
--- a/cli/tests/unit/urlpattern_test.ts
+++ b/cli/tests/unit/urlpattern_test.ts
@@ -43,3 +43,18 @@ Deno.test(function urlPatternFromInit() {
 
   assert(pattern.test({ pathname: "/foo/x" }));
 });
+
+Deno.test(function urlPatternWithPrototypePollution() {
+  const originalExec = RegExp.prototype.exec;
+  try {
+    RegExp.prototype.exec = () => {
+      throw Error();
+    };
+    const pattern = new URLPattern({
+      pathname: "/foo/:bar",
+    });
+    assert(pattern.test("https://deno.land/foo/x"));
+  } finally {
+    RegExp.prototype.exec = originalExec;
+  }
+});