Steps to reproduce the problem

1. In browser console, execute the following code:

function throwError() { throw new Error(); }

function isProxy(obj) {
	try {
		throwError.call(obj);
	} catch (e) {
		const { stack } = e;
		if (stack && stack.split('\n')[1]?.indexOf('Proxy') !== -1) {
			return true;
		}
	}
	return false;
}

2. Execute isProxy(new Proxy({}, {})) (it will print true).

Problem Description

Chrome's stack trace inadvertently exposes a presence of Proxy. Proxy is supposed to be transparent in most scenario, but Chrome's specific implementation of stack trace API (which is not a part of the specification) provides an easy way of detecting whether an object is a Proxy or not.

When a stack frame is a method call, Chrome tries to infer the type name of the this value of the frame, at CallSiteInfo::GetTypeName (see https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/call-site-info.cc;drc=304476fc888332d14c19ecc697414b5d29a55d97;l=519).

When it encounters a Proxy, it gives up too easily and simply return Proxy. As a result, a stack trace from an error thrown from throwError.call(obj); in the above code becomes:

Error
    at Proxy.throwError (<anonymous>:3:8)
    at <anonymous>:2:14

From this, one can easily create a helper function that very reliably detects a Proxy.

While there are various cases where Proxy can't fully emulate certain types of objects, mostly due to the inability to proxy "internal slots", there isn't a generic way to detect any proxies, as far as I am aware of, except for this Chrome stack trace exploit.

I suppose this loophole can easily be plugged, by doing a little bit of more work in stack trace generation and try to get the type name of a Proxy from its original object that is being proxied. It appears that Chrome is taking some care not to execute user code during such stack trace generation, and getting an original object from a Proxy could be done in such a way.

Summary

Chrome's error stack traces exposes Proxies to user codes.

Custom Questions

Which component does this fall under?

Not sure - I don't know

Does this work in other browsers?

Yes - This is just a Chrome problem

Additional Data

Category: JavaScript
Chrome Channel: Stable
Regression: N/A