Cordova 10 error when adding or removing platform

[cumpstey]

Bug Report

Problem

Updating an existing project from Cordova 9 to 10, I get an error when trying to add or remove a platform. Then tried with new Ionic project in clean Node installation, and get the same error.

What is expected to happen?

> cordova platform add android

The Android platform is added to the project.

> cordova platform remove android

The Android platform is removed from the project (or a message saying it's not part of the project).

What does actually happen?

ncumpstey@Apps-MBP test % cordova platform add android --verbose
No scripts found for hook "before_platform_add".
No version supplied. Retrieving version from config.xml...
Grabbing pinned version.
Using cordova-fetch for cordova-android@^9.0.0
fetch: Installing cordova-android@^9.0.0 to /Users/ncumpstey/Documents/Projects/test
Failed to fetch platform cordova-android@^9.0.0
Probably this is either a connection problem, or platform spec is incorrect.
Check your connection and platform name/version/URL.
CordovaError: TypeError: Cannot assign to read only property 'valueOf' of object '[object Object]'
CordovaError: Failed to fetch platform cordova-android@^9.0.0
Probably this is either a connection problem, or platform spec is incorrect.
Check your connection and platform name/version/URL.
CordovaError: TypeError: Cannot assign to read only property 'valueOf' of object '[object Object]'
    at /Users/ncumpstey/.nvm/versions/node/v12.20.0/lib/node_modules/cordova/node_modules/cordova-lib/src/cordova/platform/addHelper.js:288:31

ncumpstey@Apps-MBP test % cordova platform remove android --verbose
No scripts found for hook "before_platform_rm".
Removing platform android from platforms.json file...
TypeError: Cannot assign to read only property 'valueOf' of object '[object Object]'
    at Function.defer (/Users/ncumpstey/.nvm/versions/node/v12.20.0/lib/node_modules/cordova/node_modules/q/q.js:576:21)
    at Object.exports.spawn (/Users/ncumpstey/.nvm/versions/node/v12.20.0/lib/node_modules/cordova/node_modules/cordova-common/src/superspawn.js:64:17)
    at /Users/ncumpstey/.nvm/versions/node/v12.20.0/lib/node_modules/cordova/node_modules/cordova-fetch/index.js:177:31
CordovaError: TypeError: Cannot assign to read only property 'valueOf' of object '[object Object]'
    at /Users/ncumpstey/.nvm/versions/node/v12.20.0/lib/node_modules/cordova/node_modules/cordova-fetch/index.js:180:19

Information

Command or Code

> cordova platform add android
> cordova platform remove android

Environment, Platform, Device

Mac

Version information

MacOS 10.15.7
Node 12.20.0 and 10.15.3 - same behaviour in both.
Cordova CLI 10.0.0
Ionic CLI 6.12.2

Checklist

• I searched for existing GitHub issues
• I updated all Cordova tooling to most recent version
• I included all the necessary information above

[breautek]

Problem appears to be coming from a sub-dependency.

My first guess is that a sub-dependency didn't get updated properly on your upgrade. This can happen sometimes when doing upgrades because of how NPM and package locks work...

Can you try the following:

1. Delete node_modules folder
2. Delete platforms folder - Read the note below
3. Delete plugins folder
4. Delete package-lock.json file

If you use a global cordova installation, then do: npm uninstall -g cordova && npm install -g cordova

5. run npm install
6. run cordova platform add android

The above will forcefully remove all your dependencies, platforms and plugins. If you made any custom modifications to your platform(s), it is important you backup those changes.. Then, it will reinstall your dependencies. The platform add command will restore your cordova plugins. The result is everything is installed from scratch.

Let me know if this helps.

[cumpstey]

Thanks, but I tried all that, before trying a new project in a new Node install (with nvm). I reckoned the new project in clean install would remove the possibility of lingering relics, but I still got the error.

[RianFuro]

The problem is this commit from a dependency of cordova-cli: sebhildebrandt/systeminformation@44da17c

It sets an Object.freeze(Object.prototype) which makes yet another dependency (cordova-cli -> cordova-common -> q) fail here: https://github.com/kriskowal/q/blob/6bc7f524eb104aca8bffde95f180b5210eb8dd4b/q.js#L576

because Object.prototype.valueOf cannot be overridden anymore when the former dependency got sourced. Not sure how to fix this mess ad-hoc

[raphinesse]

Geez, fixing a prototype pollution issue in a library by freezing the String and Object prototypes... Well, on the upside that is fixing prototype pollution for everyone! 😂

But seriously, I think the fix here is to report this as an issue in systeminformation.

[RianFuro]

I at least bumped them about the issue here: sebhildebrandt/systeminformation#443
Maybe they're up to reverse that as quickly as they introduced that

[chrilyng]

The problem is this commit from a dependency of cordova-cli: sebhildebrandt/systeminformation@44da17c

It sets an Object.freeze(Object.prototype) which makes yet another dependency (cordova-cli -> cordova-common -> q) fail here: https://github.com/kriskowal/q/blob/6bc7f524eb104aca8bffde95f180b5210eb8dd4b/q.js#L576

because Object.prototype.valueOf cannot be overridden anymore when the former dependency got sourced. Not sure how to fix this mess ad-hoc

Well spotted, thanks!
Without being well-versed in npm my workaround until it's fixed is installing an older version of this dependency:

npm i systeminformation@4.30.1

and installing cordova locally as well to run the following just to get stuff running locally again.

./node_modules/cordova/bin/cordova platform add ...

[brody2consult]

I just raised PR #544 from the web GUI as a quick workaround to pin systeminformation@4.30.2, not yet tested. If anyone else has a better solution then please feel free to raise it. I should be able to test it in the next 1-2 days in case no one else wants to pick this up.

As I said in PR #422, this would not have happened if we had been using npm-shrinkwrap.json.

[RianFuro]

Upstream issue just (well, an hour ago) got fixed, so a simple reinstall of cordova should fix the issue :)

[breautek]

Upstream issue just (well, an hour ago) got fixed, so a simple reinstall of cordova should fix the issue :)

Thank you @RianFuro for leading communications and thank you @sebhildebrandt for your prompt action.

[RianFuro]

Glad I could help clear this up 🙇