« Return to Thread: Another de-facto insecurity we need to fix in ES5

Re: Another de-facto insecurity we need to fix in ES5

by Christian Plesner Hansen-3 :: Rate this Message:

| View in Thread

> As reason for skepticism, our v8 folk cite
>
> <http://www.google.dk/codesearch?q="__proto__+%3D+"+lang:javascript>
>
>
> Seems like a fair chunk of those examples are in JS code that's not deployed
> on public Web sites.

Much of it is extension and browser implementation code, true. That
would still have to be rewritten unless we go for a model where we
disallow [[Prototype]] changes only for external js.

If you ignore internal js code there still seems to be a fair amount
left: code that runs in all browsers but checks that __proto__ is
present before writing to it or code that is only ever served to or
used with certain implementations (including rhino server-side).

But as Mark said, if these turn out to be non-problems or if we can
work around them then we're very sympathetic to the idea of a
read-only [[Prototype]].


-- Christian
_______________________________________________
es-discuss mailing list
es-discuss@...
https://mail.mozilla.org/listinfo/es-discuss

 « Return to Thread: Another de-facto insecurity we need to fix in ES5