Global 'crypto' object could conflict with Node REPL

tc39 / proposal-csprng

Cryptographically Secure Random Number Generation for ECMAScript

BSD 3-Clause "New" or "Revised" License

70 stars 9 forks source link

Global 'crypto' object could conflict with Node REPL #3

Open rbuckton opened 4 years ago

rbuckton commented 4 years ago

be aware that the default node repl exposes builtin modules as globals and crypto is the name of one of them.

$ echo 'typeof globalThis.crypto' | node -i
Welcome to Node.js v12.13.1.
Type ".help" for more information.
> typeof globalThis.crypto
'object'

Originally posted by @bmeck in https://github.com/tc39-transfer/proposal-csprng/pull/2#issuecomment-582939183

rbuckton commented 4 years ago

cc: @ljharb

rbuckton commented 4 years ago

I imagine there's a number of ways to address this in Node. For example: Given that its the REPL and almost guaranteed to have a developer actively interacting with the REPL, Node could chose to make their built-in crypto module available via both a crypto global and a nodeCrypto global, with a deprecation warning issued when crypto is referenced in the REPL (similar to other existing deprecation warnings issued in Node today).

I'm sure someone from Node could weigh in on this with their thoughts and concerns.

ljharb commented 4 years ago

For one, since this is just in the repl, it won't break any code, it just might confuse some users. However, require('crypto') would continue to work in the node repl.

ByteEater-pl commented 4 years ago

Maybe put it on Math where random already lives?