test_runner: improve mock.module options handling

This commit addresses several feedback items for mock.module():

- Fixes a potential prototype pollution vulnerability by using
  ObjectAssign({ __proto__: null }, ...) for property descriptors.
- Migrates legacy option warnings to use the internal
  deprecateProperty() utility for better consistency.
- Updates documentation to use "a later version" instead of "a future
  major release" for deprecation timelines, as the feature is
  experimental.
- Adds comprehensive test cases to ensure getter properties in
  mock options are correctly preserved across both module systems.

Author: Han5991

doc/api/test.md

@@ -2497,14 +2497,14 @@ changes:
     export. If the mock is a CommonJS or builtin module, this setting is used as
     the value of `module.exports`. If this value is not provided, CJS and builtin
     mocks use an empty object as the value of `module.exports`.
-    This option is deprecated and will be removed in a future major release.
+    This option is deprecated and will be removed in a later version.
     Prefer `options.exports.default`.
   * `namedExports` {Object} An optional object whose keys and values are used to
     create the named exports of the mock module. If the mock is a CommonJS or
     builtin module, these values are copied onto `module.exports`. Therefore, if a
     mock is created with both named exports and a non-object default export, the
     mock will throw an exception when used as a CJS or builtin module.
-    This option is deprecated and will be removed in a future major release.
+    This option is deprecated and will be removed in a later version.
     Prefer `options.exports`.
 * Returns: {MockModuleContext} An object that can be used to manipulate the mock.
 

lib/internal/test_runner/mock/mock.js

@@ -6,6 +6,7 @@ const {
   Error,
   FunctionPrototypeBind,
   FunctionPrototypeCall,
+  ObjectAssign,
   ObjectDefineProperty,
   ObjectGetOwnPropertyDescriptor,
   ObjectGetPrototypeOf,
@@ -34,6 +35,7 @@ const {
   URLParse,
 } = require('internal/url');
 const {
+  deprecateProperty,
   emitExperimentalWarning,
   getStructuredStack,
   kEmptyObject,
@@ -62,12 +64,14 @@ const kSupportedFormats = [
   'module',
 ];
 let sharedModuleState;
-const warnedLegacyOptions = { __proto__: null };
-const kLegacyOptionReplacements = {
-  __proto__: null,
-  defaultExport: 'options.exports.default',
-  namedExports: 'options.exports',
-};
+const deprecateNamedExports = deprecateProperty(
+  'namedExports',
+  'mock.module(): options.namedExports is deprecated. Use options.exports instead.',
+);
+const deprecateDefaultExport = deprecateProperty(
+  'defaultExport',
+  'mock.module(): options.defaultExport is deprecated. Use options.exports.default instead.',
+);
 const {
   hooks: mockHooks,
   mocks,
@@ -815,6 +819,9 @@ function normalizeModuleMockOptions(options) {
   const { cache = false } = options;
   validateBoolean(cache, 'options.cache');
 
+  deprecateNamedExports(options);
+  deprecateDefaultExport(options);
+
   const moduleExports = { __proto__: null };
 
   if ('exports' in options) {
@@ -824,16 +831,15 @@ function normalizeModuleMockOptions(options) {
 
   if ('namedExports' in options) {
     validateObject(options.namedExports, 'options.namedExports');
-    emitLegacyMockOptionWarning('namedExports');
     copyOwnProperties(options.namedExports, moduleExports);
   }
 
   if ('defaultExport' in options) {
-    emitLegacyMockOptionWarning('defaultExport');
-    ObjectDefineProperty(moduleExports, 'default', {
-      __proto__: null,
-      ...ObjectGetOwnPropertyDescriptor(options, 'defaultExport'),
-    });
+    ObjectDefineProperty(
+      moduleExports,
+      'default',
+      ObjectAssign({ __proto__: null }, ObjectGetOwnPropertyDescriptor(options, 'defaultExport')),
+    );
   }
 
   return {
@@ -843,15 +849,6 @@ function normalizeModuleMockOptions(options) {
   };
 }
 
-function emitLegacyMockOptionWarning(option) {
-  if (warnedLegacyOptions[option]) return;
-  warnedLegacyOptions[option] = true;
-  process.emitWarning(
-    `mock.module(): options.${option} is deprecated. ` +
-    `Use ${kLegacyOptionReplacements[option]} instead.`,
-    'DeprecationWarning',
-  );
-}
 
 function copyOwnProperties(from, to) {
   const keys = ObjectKeys(from);

test/parallel/test-runner-module-mocking.js

@@ -690,6 +690,43 @@ test('exports option works with core module mocks in both module systems', async
   });
 });
 
+async function assertGetterMockWorksInBothSystems(t, mockOptionsFactory) {
+  const fixturePath = fixtures.path('module-mocking', 'basic-esm.mjs');
+  const fixture = pathToFileURL(fixturePath);
+  const original = await import(fixture);
+  let getterCalls = 0;
+
+  assert.strictEqual(original.string, 'original esm string');
+
+  const options = mockOptionsFactory(() => {
+    getterCalls++;
+    return { mocked: true };
+  });
+
+  t.mock.module(`${fixture}`, options);
+
+  assert.deepStrictEqual((await import(fixture)).default, { mocked: true });
+  assert.deepStrictEqual(require(fixturePath), { mocked: true });
+  assert.strictEqual(getterCalls, 2);
+}
+
+test('defaultExports getter works in both module systems', async (t) => {
+  await assertGetterMockWorksInBothSystems(t, (getter) => ({
+    get defaultExport() {
+      return getter();
+    },
+  }));
+});
+
+test('exports.default getter works in both module systems', async (t) => {
+  await assertGetterMockWorksInBothSystems(t, (getter) => ({
+    exports: {
+      get default() {
+        return getter();
+      },
+    },
+  }));
+});
 test('exports option supports default for CJS mocks in both module systems', async (t) => {
   const fixturePath = fixtures.path('module-mocking', 'basic-cjs.js');
   const fixture = pathToFileURL(fixturePath);