endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
829 stars 72 forks source link

Exo classes need to handle non-enumerable raw methods correctly. #1817

Closed erights closed 1 year ago

erights commented 1 year ago

Currently, the exo class creation functions fail to handle non-enumerable raw methods correctly.

At https://github.com/endojs/endo/blob/877be984d7c0ba1a85ca1ad21dddc5607bc7edfa/packages/exo/src/exo-tools.js#L291

the code uses ... destructuring to take apart a collection of raw methods. But ... destructuring only gathers enumerable own methods.

At https://github.com/endojs/endo/blob/877be984d7c0ba1a85ca1ad21dddc5607bc7edfa/packages/exo/src/exo-tools.js#L268

the code uses ... to add the raw methods into a larger collection of methods. But ... only extracts enumerable own methods.

So far, all raw methods arguments to the exo makers formed the collection of raw methods using an object literal, so all the methods were enumerable-own anyway. However, this code is intended to support use of a JavaScript class' .prototype as a collection of raw methods. These two flaws prevent that.