policy: handle mainModule.__proto__ bypass

Backport-PR-URL: nodejs-private/node-private#418
PR-URL: nodejs-private/node-private#416
Fixes: https://hackerone.com/bugs?subject=nodejs&report_id=1877919
Reviewed-By: Rich Trott <rtrott@gmail.com>
CVE-ID: CVE-2023-30581

Author: RafaelGSS

lib/internal/modules/cjs/loader.js

@@ -226,6 +226,8 @@ function Module(id = '', parent) {
     redirects = policy.manifest.getDependencyMapper(moduleURL);
     // TODO(rafaelgss): remove the necessity of this branch
     setOwnProperty(this, 'require', makeRequireFunction(this, redirects));
+    // eslint-disable-next-line no-proto
+    setOwnProperty(this.__proto__, 'require', makeRequireFunction(this, redirects));
   }
   this[require_private_symbol] = internalRequire;
 }
@@ -892,7 +894,7 @@ Module._load = function(request, parent, isMain) {
   const module = cachedModule || new Module(filename, parent);
 
   if (isMain) {
-    process.mainModule = module;
+    setOwnProperty(process, 'mainModule', module);
     setOwnProperty(module.require, 'main', process.mainModule);
     module.id = '.';
   }

test/fixtures/policy-manifest/main-module-proto-bypass.js

@@ -0,0 +1 @@
+process.mainModule.__proto__.require("os")

test/parallel/test-policy-manifest.js

@@ -66,3 +66,18 @@ const fixtures = require('../common/fixtures.js');
 
   assert.strictEqual(result.status, 0);
 }
+
+{
+  const policyFilepath = fixtures.path('policy-manifest', 'onerror-exit.json');
+  const mainModuleBypass = fixtures.path('policy-manifest', 'main-module-proto-bypass.js');
+  const result = spawnSync(process.execPath, [
+    '--experimental-policy',
+    policyFilepath,
+    mainModuleBypass,
+  ]);
+
+  assert.notStrictEqual(result.status, 0);
+  const stderr = result.stderr.toString();
+  assert.match(stderr, /ERR_MANIFEST_DEPENDENCY_MISSING/);
+  assert.match(stderr, /does not list os as a dependency specifier for conditions: require, node, node-addons/);
+}