[philipp-classen]

The first commit did not override a handler's own setPrototypeOf trap. The second commit lost that: its cycle check replaced the trap. This commit makes the trap work again.

The cycle check runs first, then the wrapper calls the handler's trap. Page scripts cannot interfere with that call.

---

Otherwise, something like this would have worked:

self.fetch = new Proxy(self.fetch, {
  apply(target, thisArg, args) { /* filter requests */ },
  setPrototypeOf() { return false; }, // nobody may re-prototype our fetch
});

A page script trying to overwrite the prototype:

Object.setPrototypeOf(fetch, { evil: true });

Without it, the page's version would have won, not the scriptlet's version.

---

For clarification: this intends to close a hole that we did not have in the beginning (on the current main branch), but would get introduce by the second commit of #67 in 026a6e8

It is not actively exploited in the wild, because the production version is not affected.

[chrmod]

Is this going to be used? I couldn't find any scriptlet that sets its own setPrototypeOf trap, so I'm not sure what this change is for.

Ignore - I got it wrong.