Fix more sandbox escapes

lib/bridge.js

@@ -158,18 +158,19 @@ function thisIdMapping(factory, other) {
 const thisThrowOnKeyAccessHandler = thisObjectFreeze({
 	__proto__: null,
 	get(target, key, receiver) {
+		if (key === 'isProxy') return true;
 		if (typeof key === 'symbol') {
 			key = thisReflectApply(thisSymbolToString, key, []);
 		}
 		throw new VMError(`Unexpected access to key '${key}'`);
 	}
 });
 
-const emptyForzenObject = thisObjectFreeze({
+const emptyFrozenObject = thisObjectFreeze({
 	__proto__: null
 });
 
-const thisThrowOnKeyAccess = new ThisProxy(emptyForzenObject, thisThrowOnKeyAccessHandler);
+const thisThrowOnKeyAccess = new ThisProxy(emptyFrozenObject, thisThrowOnKeyAccessHandler);
 
 function SafeBase() {}
 
@@ -413,12 +414,16 @@ function createBridge(otherInit, registerProxy) {
 		}
 
 		get(target, key, receiver) {
+			if (key === 'isProxy') return true;
 			// Note: target@this(unsafe) key@prim receiver@this(unsafe) throws@this(unsafe)
 			const object = this.getObject(); // @other(unsafe)
 			switch (key) {
 				case 'constructor': {
 					const desc = otherSafeGetOwnPropertyDescriptor(object, key);
-					if (desc) return thisDefaultGet(this, object, key, desc);
+					if (desc) {
+						if (desc.value && desc.value.name === 'Function') return {};
+						return thisDefaultGet(this, object, key, desc);
+					}
 					const proto = thisReflectGetPrototypeOf(target);
 					return proto === null ? undefined : proto.constructor;
 				}
@@ -782,6 +787,7 @@ function createBridge(otherInit, registerProxy) {
 		}
 
 		get(target, key, receiver) {
+			if (key === 'isProxy') return true;
 			// Note: target@this(unsafe) key@prim receiver@this(unsafe) throws@this(unsafe)
 			const object = this.getObject(); // @other(unsafe)
 			const mock = this.mock;
@@ -812,7 +818,7 @@ function createBridge(otherInit, registerProxy) {
 			thisReflectApply(thisWeakMapSet, mappingOtherToThis, [other, proxy]);
 			return proxy;
 		}
-		const proxy2 = new ThisProxy(proxy, emptyForzenObject);
+		const proxy2 = new ThisProxy(proxy, emptyFrozenObject);
 		try {
 			otherReflectApply(otherWeakMapSet, mappingThisToOther, [proxy2, other]);
 			registerProxy(proxy2, handler);

lib/setup-sandbox.js

@@ -28,7 +28,24 @@ const {
 	getOwnPropertyDescriptor: localReflectGetOwnPropertyDescriptor
 } = localReflect;
 
+const speciesSymbol = Symbol.species;
+const globalPromise = global.Promise;
+class localPromise extends globalPromise {}
+
+const blockPromiseSpecies = (p, Class) => {
+	if (p instanceof Class && p.constructor[speciesSymbol] !== Class) {
+		throw new Error('Sandbox escape attempt blocked');
+	}
+};
+
+const globalPromiseThen = globalPromise.prototype.then;
+globalPromise.prototype.then = function then(onFulfilled, onRejected) {
+	blockPromiseSpecies(this, globalPromise);
+	return globalPromiseThen.call(this, onFulfilled, onRejected);
+};
+
 const localReflectApply = (target, thisArg, args) => {
+	blockPromiseSpecies(thisArg, localPromise);
 	return apply(target, thisArg, args);
 };
 
@@ -67,7 +84,6 @@ function localUnexpected() {
 // global is originally prototype of host.Object so it can be used to climb up from the sandbox.
 if (!localReflectSetPrototypeOf(context, localObject.prototype)) throw localUnexpected();
 
-class localPromise extends global.Promise {}
 Object.defineProperties(global, {
 	global: {value: global, writable: true, configurable: true, enumerable: true},
 	globalThis: {value: global, writable: true, configurable: true},
@@ -468,6 +484,7 @@ const makeSafeArgs = Object.freeze({
 const proxyHandlerHandler = Object.freeze({
 	__proto__: null,
 	get(target, name, receiver) {
+		if (name === 'isProxy') return true;
 		const value = target.handler[name];
 		if (typeof value !== 'function') return value;
 		return new LocalProxy(value, makeSafeArgs);
@@ -539,6 +556,12 @@ if (localPromise) {
 	Object.freeze(PromisePrototype);
 }
 
+localObject.defineProperty(localObject, 'setPrototypeOf', {
+	value: () => {
+		throw new VMError('Operation not allowed on contextified object.');
+	}
+});
+
 function readonly(other, mock) {
 	// Note: other@other(unsafe) mock@other(unsafe) returns@this(unsafe) throws@this(unsafe)
 	if (!mock) return fromWithFactory(readonlyFactory, other);

package.json

@@ -25,9 +25,9 @@
   },
   "engines": {
     "node": ">=18.10",
-    "pnpm": ">=8.6.12"
+    "pnpm": ">=9.6"
   },
-  "packageManager": "pnpm@8.6.12",
+  "packageManager": "pnpm@9.6.0",
   "scripts": {
     "test": "mocha test",
     "pretest": "eslint ."