DOMException's name->code mapping object observably accesses userland mutable Object.prototype

[ghost]

Erroneous example code:

const new_code = 100;
Object.prototype.s = new_code;
console.log(new_code === new DOMException("", "s").code);

result: true.
This is a result of using a plain JS object here:

deno/ext/web/01_dom_exception.js

Lines 56 to 79 in 5f405bf

	const nameToCodeMapping = {
	IndexSizeError: INDEX_SIZE_ERR,
	HierarchyRequestError: HIERARCHY_REQUEST_ERR,
	WrongDocumentError: WRONG_DOCUMENT_ERR,
	InvalidCharacterError: INVALID_CHARACTER_ERR,
	NoModificationAllowedError: NO_MODIFICATION_ALLOWED_ERR,
	NotFoundError: NOT_FOUND_ERR,
	NotSupportedError: NOT_SUPPORTED_ERR,
	InUseAttributeError: INUSE_ATTRIBUTE_ERR,
	InvalidStateError: INVALID_STATE_ERR,
	SyntaxError: SYNTAX_ERR,
	InvalidModificationError: INVALID_MODIFICATION_ERR,
	NamespaceError: NAMESPACE_ERR,
	InvalidAccessError: INVALID_ACCESS_ERR,
	TypeMismatchError: TYPE_MISMATCH_ERR,
	SecurityError: SECURITY_ERR,
	NetworkError: NETWORK_ERR,
	AbortError: ABORT_ERR,
	URLMismatchError: URL_MISMATCH_ERR,
	QuotaExceededError: QUOTA_EXCEEDED_ERR,
	TimeoutError: TIMEOUT_ERR,
	InvalidNodeTypeError: INVALID_NODE_TYPE_ERR,
	DataCloneError: DATA_CLONE_ERR,
	};

This could be fixed by not using the object prototype, like so:

  const nameToCodeMapping = {
    __proto__: null,
    IndexSizeError: INDEX_SIZE_ERR,
    HierarchyRequestError: HIERARCHY_REQUEST_ERR,