Can't console.log() in body

[popovichN]

Would be nice to be able to console.log() data properties within the html/body, like you can in Ractive. I.e. {{console.log(data)}}

[Rich-Harris]

Yep, this is a useful debugging technique. Also, it's useful to be able to use certain other globals like Math so that you can do {{Math.round(someValue)}} and so on. Ractive and Vue both have a whitelist (here and here) of which globals you can use.

Something just occurred to me though – in Ractive, {{foo}} results in the empty string if foo is undefined. In Svelte, it actually prints undefined. Since console.log(...) returns undefined, you'd get the same result. Two options:

• Deal with it (aka {{console.log(myValue) || ''}}, if you don't want to render undefined)
• Add some special logic for dealing with console.* expressions

Either way we should do the global whitelisting thing

[Ryuno-Ki]

I wonder what would happen if someone would overwrite a global … I know, it's bad style. But I can imagine this being an attack vector (for example distributed over an advertisement network …).

[Ryuno-Ki]

One way would be to compare to “builtins” of an iFrame (since it creates a new global context).

[Rich-Harris]

I wonder what would happen if someone would overwrite a global … I know, it's bad style. But I can imagine this being an attack vector (for example distributed over an advertisement network …).

If an attacker is able to use that vector, I think you've already lost – you wouldn't be able to use any builtins. I don't think people should expect Svelte components to resist attacks that regular JS can't. Though it would be worth documenting that you can do this to at least prevent globals being reassigned after you've created the component:

<script>
  export default {
    helpers: {
      Math
    }
  };
</script>

[Ryuno-Ki]

Ah, right. This is currently possible as well. Haven't thought of that! Security is so hard … so many things to keep in mind …