feat(bson-parsing): restrict web worker scope COMPASS-11128

[mabaasit]

Description

COMPASS-11128

Open Questions

Checklist

• I have signed the Contributor License Agreement (https://www.mongodb.com/legal/contributor-agreement)
• New tests and/or benchmarks are included
• Documentation is changed or added

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[addaleax]

Adding const { self, onmessage, postMessage } = globalThis; above this statement should remove this requirement, and we do want to avoid a situation where the "sandbox" could call postMessage()

[mabaasit]

Yes, that's much better and will clean this up

[addaleax]

Buffer is a Node.js concept, do we need that?

[mabaasit]

It was added to support the usage around LegacyUUID in scope.ts. I switched to bson.ByteUtils instead in 4623dfa.

Also, now that we added support for node as well, I've to keep it as web-worker package relies on it

[LuciaHarcekova]

Hi @mabaasit, the ticket says to remove Node globals, but the PR’s allowlist still includes both process and Buffer. The comment says process is needed by the web-worker package. You mentioned the code switched to bson.ByteUtils instead of Buffer (I can't open 4623dfa link - if it's addressed there). Confirming whether Buffer is still needed and whether keeping process is an acceptable exception to the task’s security goal.

[mabaasit]

5a5cddb

[addaleax]

Object.prototype.constructor is part of standard JS, why are we excluding that?

[Copilot]

Copilot review overview

🟡 Changes recommended

The worker response callback can break, and test environment cleanup is incorrect.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Preserve postMessage when restricting worker global scope · New

What changed in this PR

This pull request hardens the BSON parser web worker by restricting its scope and expanding worker tests.

Changes:

• Restricts worker globals and prototypes.
• Supports direct worker URLs in tests.
• Adds worker lifecycle and security coverage.

File	Summary
packages/​shell-bson-parser/​src/​worker.ts	Restricts worker capabilities. Critical (3 votes): postMessage must remain available.
packages/​shell-bson-parser/​src/​worker-client.ts	Adds test worker URL handling.
packages/​shell-bson-parser/​src/​index.spec.ts	Expands worker behavior tests. Moderate (1 vote): delete the environment variable instead of assigning undefined.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mabaasit]

addressed in a1d77b8

[mabaasit]

c6d9db7 thanks to rebasing :) (commit title: clean up postMessage)

[codeowners-service-app]

Assigned lerouxb for team mongosh-developers because LuciaHarcekova is out of office.

[coveralls]

coverage: 79.958% (-0.02%) from 79.981% — restrict-worker-scope into web-worker-parsing

[LuciaHarcekova]

Based on what data is the full allow list constructed?

I could see "console" isn't in allow list. Could be the case web-worker's Node shim calls console.error when a handler throws, which would turn errors into confusing ReferenceErrors.

[mabaasit]

This list is based on the current tests, integration with compass, globals needed for parsing etc.
Nice catch with console. I'll add that to this list

[LuciaHarcekova]

Approved.

The core approach looks solid. The allowlist-then-delete pattern is appropriate, and Object.getOwnPropertyNames correctly includes non-enumerable globals. restrictObjectPrototype is also a valuable layer of protection against prototype-pollution gadgets.

I verified that require, global, fetch, eval, XMLHttpRequest, WebAssembly, and setTimeout are removed. Thanks for addressing the review feedback, including switching from Buffer to bson.ByteUtils and capturing postMessage before restricting the global scope.

nit: please update the PR description with links to the relevant data and a brief note mapping the requirements from those sources to the implementation, so reviewers can verify that the full scope is covered.