tc39 / proposal-global

ECMAScript Proposal, specs, and reference implementation for `global`
http://tc39.github.io/proposal-global/
MIT License
349 stars 18 forks source link

Why not getting it from Object? #28

Closed mgtitimoli closed 5 years ago

mgtitimoli commented 5 years ago

Hi there,

My apologies if you have already discarded this possibility, but I was wondering if you have ever considered adding a static method, getter, or property to Object to get global instead of adding a global variable to hold it.

In other words, the options that I mentioned before are:

  1. Object.getGlobal()
  2. Object.global
naholyr commented 5 years ago

I'm really disturbed by the name, and I think no name will properly do the job, a big :+1: on putting it as property of Object! I'd favor Object.global (or Object.GLOBAL) over the getter, for sake conciseness.

ljharb commented 5 years ago

That's a non-starter, because then it couldn't be denied to untrusted code by altering the variable scope. Separately, that would mean that from almost every object, you could get to the global object on its original realm - which would be a huge security violation.

Thus, it must not be a property on any object (besides itself), and it must not be syntax, which means it must only be a global variable.

hax commented 5 years ago

it couldn't be denied to untrusted code by altering the variable scope

@ljharb I'm not sure I understand correctly about that. Do you mean

const globalThis = undefined
eval(untrustedCode)

to avoid untrustedCode to access globalThis?

you could get to the global object on its original realm - which would be a huge security violation.

So could we use Realm.global instead of Object.global?

ljharb commented 5 years ago

Yes.

Virtualization is required per compartment, not just per realm, so attaching it to (the as yet nonexistent) Realm won’t work either.

Please see https://github.com/tc39/proposal-global/blob/master/NAMING.md for the list of constraints.

hax commented 5 years ago

@ljharb Thank you for your patience. I will read NAMING.md and try to understand the all constraints.