lib: harden kKeyOps lookup with null prototype

Signed-off-by: Filip Skokan <[email protected]>
PR-URL: #62877
Reviewed-By: René <[email protected]>
Reviewed-By: Jordan Harband <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>

Author: panva

lib/internal/crypto/util.js

@@ -764,6 +764,7 @@ function getDigestSizeInBytes(name) {
 }
 
 const kKeyOps = {
+  __proto__: null,
   sign: 1,
   verify: 2,
   encrypt: 3,

test/parallel/test-webcrypto-util.js

@@ -9,6 +9,7 @@ const assert = require('assert');
 
 const {
   normalizeAlgorithm,
+  validateKeyOps,
 } = require('internal/crypto/util');
 
 {
@@ -49,3 +50,12 @@ const {
   assert.strictEqual(normalized.name, 'ECDSA');
   assert.strictEqual(nameReadCount, 1);
 }
+
+{
+  for (const ops of [
+    ['sign', 'toString', 'constructor'],
+    ['sign', '__proto__', 'constructor'],
+  ]) {
+    validateKeyOps(ops);
+  }
+}