node: warn for Object.prototype.__* accessors common in security warnings

doc/api/deprecations.md

@@ -2801,7 +2801,30 @@ non-number value for `hints` option, a non-nullish non-boolean value for `all`
 option, or a non-nullish non-boolean value for `verbatim` option in
 [`dns.lookup()`][] and [`dnsPromises.lookup()`][] is deprecated.
 
+### DEP0XXX: `Object.prototype` Legacy Accessors
+<!-- YAML
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/39824
+    description: Runtime deprecation.
+-->
+
+Type: Runtime
+
+Accessors on `Object.prototype` are subject to object traversal attacks and
+cause concerns for security audits. A variety of these are considered deprecated
+by the [Legacy Object.prototype Accessor Methods][] by the JS standard. Modern
+replacements are `Object.defineProperty`, `Object.getPrototypeOf`, and
+`Object.setPrototypeOf` and not subject to path traversal. This affects:
+
+* `Object.prototype.__defineGetter__`
+* `Object.prototype.__defineSetter__`
+* `Object.prototype.__lookupGetter__`
+* `Object.prototype.__lookupSetter__`
+* `Object.prototype.__proto__`
+
 [Legacy URL API]: url.md#url_legacy_url_api
+[Legacy Object.prototype Accessor Methods]: https://tc39.es/ecma262/#sec-object.prototype-legacy-accessor-methods
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
 [WHATWG URL API]: url.md#url_the_whatwg_url_api

lib/internal/bootstrap/pre_execution.js

@@ -3,10 +3,13 @@
 const {
   NumberParseInt,
   ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectPrototype,
   SafeMap,
   SafeWeakMap,
   StringPrototypeStartsWith,
   globalThis,
+  uncurryThis,
 } = primordials;
 
 const {
@@ -332,6 +335,56 @@ function initializeDeprecations() {
     enumerable: false,
     configurable: true
   });
+
+  const legacy = [
+    ['__proto__', {
+      get: 'Object.getPrototypeOf',
+      set: 'Object.setPrototypeOf'
+    }],
+    ['__defineGetter__', 'Object.defineProperty'],
+    ['__defineSetter__', 'Object.defineProperty'],
+    ['__lookupGetter__', 'Object.getOwnPropertyDescriptor'],
+    ['__lookupSetter__', 'Object.getOwnPropertyDescriptor'],
+  ];
+  for (let i = 0; i < legacy.length; i++) {
+    const prop = legacy[i][0];
+    const replacement = legacy[i][1];
+    const getReplacement = typeof replacement === 'string' ?
+      replacement : replacement.get;
+    const setReplacement = typeof replacement === 'string' ?
+      replacement : replacement.set;
+    const protoDescriptor = ObjectGetOwnPropertyDescriptor(
+      ObjectPrototype,
+      prop);
+    if (protoDescriptor && 'value' in protoDescriptor) {
+      let value = protoDescriptor.value;
+      const writable = protoDescriptor.writable;
+      ObjectDefineProperty(ObjectPrototype, prop, {
+        get: deprecate(function() {
+          return value;
+        }, `${prop} is deprecated, use ${getReplacement} instead`, 'DEP0XXX'),
+        set: deprecate(function(v) {
+          if (!writable) return;
+          value = v;
+        }, `${prop} is deprecated, use ${setReplacement} instead`, 'DEP0XXX'),
+        enumerable: false,
+        configurable: true
+      });
+    } else {
+      const getter = uncurryThis(protoDescriptor.get);
+      const setter = uncurryThis(protoDescriptor.set);
+      ObjectDefineProperty(ObjectPrototype, prop, {
+        get: deprecate(function() {
+          return getter(this);
+        }, `${prop} is deprecated, use ${getReplacement} instead`, 'DEP0XXX'),
+        set: deprecate(function(value) {
+          setter(this, value);
+        }, `${prop} is deprecated, use ${setReplacement} instead`, 'DEP0XXX'),
+        enumerable: false,
+        configurable: true
+      });
+    }
+  }
 }
 
 function setupChildProcessIpcChannel() {

test/parallel/test-object-proto-accessor-warning.js

@@ -0,0 +1,13 @@
+'use strict';
+
+const common = require('../common');
+
+common.expectWarning(
+  'DeprecationWarning',
+  '__proto__ is deprecated, use Object.getPrototypeOf instead', 'DEP0XXX');
+
+const obj = {};
+// eslint-disable-next-line
+const _ = obj.__proto__;
+// eslint-disable-next-line
+obj.__proto__ = null;

test/parallel/test-repl-tab-complete.js

@@ -550,6 +550,7 @@ testMe.complete('obj.', common.mustCall(function(error, data) {
 
     data[0].forEach((key) => {
       if (!key || key === 'ele.biu') return;
+      console.error(key, ele[key.substr(4)]);
       assert.notStrictEqual(ele[key.substr(4)], undefined);
     });
   }));