Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prototyped Scopes #888

Merged
merged 8 commits into from Jul 5, 2017
Merged

Commits on Jun 29, 2017

  1. Refactor isSafe checks to restore inheritance

    To safely restore inherited properties and methods on plain objects e.g
    with Object.create, some overly broad conditions need to be removed and
    others added to more explicitly exclude unsafe properties.
    
    isSafeMethod() has been modified as bellow, roughly the same conditions
    are also now used in isSafeProperty() for get/setSafeProperty() which
    previously restricted all inherited properties.
    
    - Require __proto__ to have own-method
    	Intended to prevent ghosting of class methods, but also prevents
    	access to properties from further up the chain.
    
    + Require any own-method to not be in __proto__
    	Explicitly prevents ghosting but not inheritance. Possible to
    	defeat only if proto chaining through Object.create is allowed.
    
    - Require object to not be function
    	Intended to prevent unsafe function methods like 'bind', but
    	also restricts function own-properties.
    
    + Require method not be in Function.prototype
    	Explicitly prevents unsafe function methods like 'bind',
    	without restricting function own properties.
    
    Other conditions should be equivalent. The overall affect should be
    that inherited properties and methods that are safe and not ghosted
    should be allowed.
    ThomasBrierley committed Jun 29, 2017
    Copy the full SHA
    c4951c2 View commit details
    Browse the repository at this point in the history
  2. Copy the full SHA
    955c72b View commit details
    Browse the repository at this point in the history
  3. Copy the full SHA
    7951ae2 View commit details
    Browse the repository at this point in the history
  4. Copy the full SHA
    cc8b7a2 View commit details
    Browse the repository at this point in the history
  5. Update tests for isSafe changes

    + Fix "calling Function via Object.assign" test. Now fails on accesing
    "bind" first because new implementation is a bit more restrictive.
    
    + Fix "extend the class instance". Custom methods on instances are now
    allowed and ghosting (overridding) is explicitly not.
    
    + Add ghosting tests for class instances and plain objects.
    ThomasBrierley committed Jun 29, 2017
    Copy the full SHA
    badc6ef View commit details
    Browse the repository at this point in the history

Commits on Jul 4, 2017

  1. Use 'in' on root prototype checks

    Because on NodeJS <= v0.10 hasOwnProperty returns false for __proto__ on
    Object.prototype. Function.prototype and Object.prototype are roots so
    it should be safe to use 'in' instead.
    ThomasBrierley committed Jul 4, 2017
    Copy the full SHA
    e8ace81 View commit details
    Browse the repository at this point in the history
  2. Copy the full SHA
    7d6c583 View commit details
    Browse the repository at this point in the history
  3. Copy the full SHA
    1dd67cd View commit details
    Browse the repository at this point in the history