Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden Snowboard #687

Merged
merged 8 commits into from
Sep 13, 2022
Merged

Harden Snowboard #687

merged 8 commits into from
Sep 13, 2022

Conversation

bennothommo
Copy link
Member

This applies some hardening to the core classes in Snowboard, preventing people from accidentally (or intentionally) overwriting or misusing system methods. This also helps to prevent prototype pollution.

- The Snowboard and PluginLoader objects are now frozen and cannot be modified.
- Added a Proxy in front of Snowboard to handle plugin loading
- Plugin "Snowboard" instances are blocked from running certain methods
- Update tests to check hardening
@bennothommo
Copy link
Member Author

I've tested this on the new website (and Docs theme), which use extensive Snowboard plugins and have not encountered any issues with this hardening in place, so just need the tick of approval on code style. Happy to explain how this works too if need be 😛

@bennothommo bennothommo marked this pull request as ready for review September 12, 2022 13:55
@bennothommo bennothommo merged commit 2a13faf into develop Sep 13, 2022
@bennothommo bennothommo deleted the wip/harden-snowboard branch September 13, 2022 01:04
bennothommo added a commit that referenced this pull request Sep 16, 2022
Backport from 1.2 branch.

- The Snowboard and PluginLoader objects are now frozen and cannot be modified.
- Added a Proxy in front of Snowboard to handle plugin loading
- Plugin "Snowboard" instances are blocked from running certain methods
- Update tests to check hardening
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants