`Cannot redefine property` when accessing properties of freezed global

[plesiecki]

Version

19.3.0

Platform

Darwin * 21.6.0 Darwin Kernel Version 21.6.0: Sat Jun 18 17:07:22 PDT 2022; root:xnu-8020.140.41~1/RELEASE_ARM64_T6000 arm64

Subsystem

No response

What steps will reproduce the bug?

Run node and enter
Object.freeze(global);console.log(AbortController)
or
Object.freeze(global);console.log(MessageChannel)

How often does it reproduce? Is there a required condition?

since v19.3

What is the expected behavior?

No error, just like for v19.2

What do you see instead?

Welcome to Node.js v19.3.0.
Type ".help" for more information.
> Object.freeze(global);console.log(MessageChannel)
Uncaught TypeError: Cannot redefine property: MessageChannel
    at defineProperty (<anonymous>)
    at set MessageChannel (node:internal/util:511:7)
    at get MessageChannel (node:internal/util:525:9)

Additional information

No response

[cjihrig]

My guess is that #45659 is the change responsible - it lazy loads globals, causing problems when you freeze global before the lazy load.

[threema-lenny]

The NodeJS docs recommend Object.freeze(globalThis) as a security best practice (see: https://nodejs.org/en/learn/getting-started/security-best-practices#monkey-patching-cwe-349), so it is somewhat alarming to see that heavily used APIs create these issues.

[threema-lenny]

I have another reproducer:

node                                                                                                        
Welcome to Node.js v22.16.0.
Type ".help" for more information.
> Object.freeze(globalThis); new WebSocket('...')
Uncaught:
TypeError: Cannot define property Symbol(undici.globalDispatcher.1), object is not extensible
    at Function.defineProperty (<anonymous>)
    at setGlobalDispatcher2 (node:internal/deps/undici/undici:8267:14)
    at lib/global.js (node:internal/deps/undici/undici:8261:7)
    at __require (node:internal/deps/undici/undici:6:50)
    at node:internal/deps/undici/undici:13504:52
    at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:399:7)
    at requireBuiltin (node:internal/bootstrap/realm:430:14)

This is also a bit annoying because it happens when importing the http module.