Some shims don’t guard against `Object.prototype` modifications #175

Closed
mathiasbynens opened this Issue Dec 18, 2013 · 2 comments

Projects

None yet

3 participants

@mathiasbynens
Contributor

Add this to the tests:

Object.prototype[1] = 42; // try to break `arguments[1]`
Object.prototype[2] = 'lol'; // try to break `arguments[2]`

Functions and methods that might have this issue:

  • Array: from, fill, find, findIndex
  • String: startsWith, endsWith, contains
@paulmillr
Owner

Is it a real concern or hasOwnProperty usage is in the spec?

@mathiasbynens
Contributor

The spec for e.g. String#startsWith says:

Step 7. Let pos be ToInteger(position). (If position is undefined, this step produces the value 0).

Luckily, there’s no need to use hasOwnProperty to detect if a secondary argument was passed or not.

I had the same problem with my polyfill. Here’s the fix: mathiasbynens/String.prototype.startsWith@978e0c2

@mathiasbynens mathiasbynens reopened this Dec 18, 2013
@ljharb ljharb was assigned Dec 18, 2013
@paulmillr paulmillr closed this in #177 Dec 19, 2013
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment