endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
829 stars 72 forks source link

feat(ses): Anticipate set-methods proposal #1970

Closed erights closed 9 months ago

erights commented 9 months ago

closes: #XXXX refs: #1969 https://github.com/tc39/proposal-set-methods

Description

Anticipates https://github.com/tc39/proposal-set-methods .

While doing #1969, I noticed

image

on the Chrome Canary console, which is SES letting us developers know that it encountered properties that it did not previously know about. No security problem, because they were all successfully removed. But the warning lets us know that we should decide what to do about these properties, including explicitly deciding that they should be deleted.

In this case, the properties are from the set-methods proposal, that we participated in at tc39 and are satisfied is safe. This PR permits them, so that SES no longer removes them.

With this PR on top of #1969, Chrome Canary's console is clean.

Security Considerations

If we missed or misunderstood something about how these set-methods behave, or of an engine's implementation did, then permitting them could introduce a new security problem. But we have no particular reason to worry about these.

Scaling Considerations

Having efficient set operations will be nice, and may eventually help us make some things faster.

Documentation Considerations

none

Testing Considerations

none

Upgrade Considerations

none