Closed michaelfig closed 5 years ago
I had not considered confine
as a way to evade such static vs dynamic restrictions, as long as the string being evaluated is valid Jessie. The mutating example is not.
This is convincing for allowing computed reads. Go ahead and whitelist.
Another related question: in your design, what makes bar.abcd = 123
invalid Jessie? Is it because it is not statically proven to be "preparing an object for delivery", or do you intend to reject it in the grammar?
My current grammars fail to parse both:
function doit() { foo[1] = 123; }
and:
function doit() { foo.abcd = 123; }
Syntax error at 25 "=" #0:25 looking for EOL_COMMENT, MULTILINE_COMMENT, callPostOp, callPostOp, memberPostOp, memberPostOp, LEFT_BRACKET, DOT, quasiExpr, QUASI_ALL, QUASI_HEAD, LATER, IDENT, args, LEFT_PAREN, multOp, addOp, shiftOp, eagerOp, relOp, eqOp, bitOp, andThenOp, orElseOp, SEMI
so I'm not so sure of your intentions as to what is statically enforced versus syntactically invalid.
Thanks, Michael.
Okay, reading further, I believe those constructs should be accepted by the grammar but the mutation of an dotted identifier should be statically rejected because the target cannot be proven to be a locally initialised object.
Y
Closed by #26
Hi,
I would like some clarification on:
I don't fully understand why computed string properties are undesirable, or even possible to reject. Does Jessie allow reading computed property names, as in:
and if computed properties are disallowed, it is still relatively easy, though tedious, to bypass with
confine
:or even (!):
The reason I ask is that using objects-as-records is painful if there is no simple way to iterate through the properties/values of the object (though I understand why
for ... in
is rejected). If you intend to disallow this too, I would like to discuss this further, as it is still possible to bypass with a combination ofJSON.stringify
andconfine
(exercise left to the reader).If it's only the mutation you want to prevent, I would suggest whitelisting
Object.keys
,Object.values
, andObject.entries
. That would make me much happier.Indeed, it turns out the only rather bizarre endowment I find passing around (to
bond
, the Jessie evaluator, and others) iscomputedGet: (obj, index) => obj[index]
. This smells like a missing feature.Thanks, Michael.