tc39 / proposal-ses

Draft proposal for SES (Secure EcmaScript)
223 stars 20 forks source link

A possible solution to resolve override mistake without break change #47

Open LongTengDao opened 10 months ago

LongTengDao commented 10 months ago

change behaviour for overriding non-writable property on proto will make peril for real world:

'use strict';
const obj = { __proto__: Object.freeze({ __proto__: null, a: null }) };
module.exports = (x) => {
    obj[x] = null;// assert x is not "a" but now it missed
    // continue to do danger things with x
};

but as a native feature, ses can stipulate the prototypes behaviour like proxy in pseudo-code below:


Object.prototype = new Proxy(Object.prototype, {
    __proto__: null,
    defineProperty: () => false,
});

it's still writable when read property descriptor, but can't modify actually.

then ses can prevent modify prototypes without changing override mechanism.

other hack precedent in js spec:

import * as mod from 'data:text/javascript,export let a = 1;';
Object.getPrototypeDescriptor(mod, 'a').writable;// true
mod.a = 2;// error