From 3b082efc85851ed9c5c7bae9bb85ed2a02f86fea Mon Sep 17 00:00:00 2001
From: Ali Hassan <ali-hassan27@outlook.com>
Date: Thu, 30 Apr 2026 15:36:28 +0500
Subject: [PATCH] lib: reject SharedArrayBuffer in Blob constructor per spec

Signed-off-by: Ali Hassan <ali-hassan27@outlook.com>
---
 lib/internal/blob.js                          | 10 ++++++--
 ...test-webapi-sharedarraybuffer-rejection.js | 24 +++++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index 5059b651f467ca..0e901d416e0430 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -127,9 +127,12 @@ function getSource(source, endings) {
 }
 
 const sourcesConverter = createSequenceConverter((source, opts = kEmptyObject) => {
-  if (isBlob(source) || isAnyArrayBuffer(source) || isArrayBufferView(source)) {
+  if (isBlob(source)) {
     return source;
   }
+  if (isAnyArrayBuffer(source) || isArrayBufferView(source)) {
+    return converters.BufferSource(source, opts);
+  }
   return converters.DOMString(source, opts);
 });
 
@@ -149,7 +152,10 @@ class Blob {
   constructor(sources = [], options) {
     markTransferMode(this, true, false);
 
-    const sources_ = sourcesConverter(sources);
+    const sources_ = sourcesConverter(sources, {
+      __proto__: null,
+      context: 'sources',
+    });
 
     validateDictionary(options, 'options');
     let {
diff --git a/test/parallel/test-webapi-sharedarraybuffer-rejection.js b/test/parallel/test-webapi-sharedarraybuffer-rejection.js
index c5503dfc0a1b2d..744c929753c285 100644
--- a/test/parallel/test-webapi-sharedarraybuffer-rejection.js
+++ b/test/parallel/test-webapi-sharedarraybuffer-rejection.js
@@ -3,6 +3,7 @@
 const common = require('../common');
 const assert = require('assert');
 const test = require('node:test');
+const { Blob } = require('buffer');
 const { ReadableStream } = require('stream/web');
 
 const sab = new SharedArrayBuffer(8);
@@ -98,6 +99,29 @@ test('ReadableByteStreamController.enqueue() rejects SAB-backed DataView', async
   reader.releaseLock();
 });
 
+// -- Blob --
+
+test('Blob rejects SharedArrayBuffer part', () => {
+  assert.throws(
+    () => new Blob([sab]),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+});
+
+test('Blob rejects SAB-backed Uint8Array part', () => {
+  assert.throws(
+    () => new Blob([sabView]),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+});
+
+test('Blob rejects SAB-backed DataView part', () => {
+  assert.throws(
+    () => new Blob([sabDataView]),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+});
+
 // -- SharedWebIDL converters --
 
 const { converters } = require('internal/webidl');