node: warn for Object.prototype.__* accessors common in security warnings

doc/api/deprecations.md

@@ -2801,7 +2801,30 @@ non-number value for `hints` option, a non-nullish non-boolean value for `all`
 option, or a non-nullish non-boolean value for `verbatim` option in
 [`dns.lookup()`][] and [`dnsPromises.lookup()`][] is deprecated.
 
+### DEP0154: `Object.prototype` Legacy Accessors
+<!-- YAML
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/39824
+    description: Runtime deprecation.
+-->
+
+Type: Runtime
+
+Accessors on `Object.prototype` are subject to object traversal attacks and
+cause concerns for security audits. A variety of these are considered deprecated
+by the [Legacy Object.prototype Accessor Methods][] by the JS standard. Modern
+replacements are `Object.defineProperty`, `Object.getPrototypeOf`, and
+`Object.setPrototypeOf` and not subject to path traversal. This affects:
+
+* `Object.prototype.__defineGetter__`
+* `Object.prototype.__defineSetter__`
+* `Object.prototype.__lookupGetter__`
+* `Object.prototype.__lookupSetter__`
+* `Object.prototype.__proto__`
+
 [Legacy URL API]: url.md#url_legacy_url_api
+[Legacy Object.prototype Accessor Methods]: https://tc39.es/ecma262/#sec-object.prototype-legacy-accessor-methods
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
 [WHATWG URL API]: url.md#url_the_whatwg_url_api

lib/internal/bootstrap/pre_execution.js

@@ -3,10 +3,13 @@
 const {
   NumberParseInt,
   ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectPrototype,
   SafeMap,
   SafeWeakMap,
   StringPrototypeStartsWith,
   globalThis,
+  uncurryThis,
 } = primordials;
 
 const {
@@ -332,6 +335,60 @@ function initializeDeprecations() {
     enumerable: false,
     configurable: true
   });
+
+  let warnedForProto = false;
+  function warnOnProto() {
+    if (!warnedForProto) {
+      warnedForProto = true;
+      process.emitWarning('usage of Object.prototype.__* properties are a' +
+        ' common security concern, use static methods on Object instead');
+    }
+  }
+  const legacy = [
+    '__proto__',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+  ];
+  for (let i = 0; i < legacy.length; i++) {
+    const prop = legacy[i];
+    const protoDescriptor = ObjectGetOwnPropertyDescriptor(
+      ObjectPrototype,
+      prop);
+    if (protoDescriptor && 'value' in protoDescriptor) {
+      let value = protoDescriptor.value;
+      const writable = protoDescriptor.writable;
+      ObjectDefineProperty(ObjectPrototype, legacy[i], {
+        get() {
+          warnOnProto();
+          return value;
+        },
+        set(v) {
+          warnOnProto();
+          if (!writable) return;
+          value = v;
+        },
+        enumerable: false,
+        configurable: true
+      });
+    } else {
+      const getter = uncurryThis(protoDescriptor.get);
+      const setter = uncurryThis(protoDescriptor.set);
+      ObjectDefineProperty(ObjectPrototype, legacy[i], {
+        get() {
+          warnOnProto();
+          return getter(this);
+        },
+        set(value) {
+          warnOnProto();
+          setter(this, value);
+        },
+        enumerable: false,
+        configurable: true
+      });
+    }
+  }
 }
 
 function setupChildProcessIpcChannel() {

test/parallel/test-object-proto-accessor-warning.js

@@ -0,0 +1,11 @@
+'use strict';
+
+const common = require('../common');
+
+process.on('warning', common.mustCall());
+
+const obj = {};
+// eslint-disable-next-line
+const _ = obj.__proto__;
+// eslint-disable-next-line
+obj.__proto__ = null;