On Sat, May 7, 2011 at 23:44, Kyle Simpson <[email protected]> wrote:
> It's a well known fact that overwriting anything in Object.prototype (like
> Object.prototype.toString, for instance) is a very bad idea, because it
> breaks for-in looping.
Properties 'properly' added/updated using Object.defineProperty
{enumerable: false} do not break for-in afaik.
> 2. Would it be possible for Object.prototype.* to be read-only for
> ES-Harmony (or even just strict mode)?
> 3. By read-only, I mean that changes to it would just silently be discarded.
> Alternatively (especially for strict mode), warnings/errors could be thrown
> if attempting to override them?
Doesn't Object.freeze(Object.prototype) provide exactly this behavior already?
>
> I think that being able to override something like Object.prototype.toString
> to "lie" about objects/values is a "security" hole we should consider
> plugging. For instance, you can "lie" to
> `document.location.href.toString()`... or a call like
> `Object.prototype.toString.call(window.opera) == "[object Opera]"` (a common
> browser inference for Opera) is easily fake'able.
Doesn't this imply the application deliberately 'lies' to itself? Not
sure to understand how would this be an issue?
It might even be sort of useful for mocking.
Regards,
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
