On Fri, Nov 4, 2011 at 10:51 AM, Jorge <[email protected]> wrote:
>
> o= makeTable();
> o.add(1);
> o.add(2);
> o.add(3);
> o.add('Yay!');
>
> o.store('__proto__', {push:function () { console.log(this) }});
> o.add();
>
> Gives:
>
> [ 1, 2, 3, 'Yay!' ]
>
Very nice! Your use of __proto__ is very clever, and should work on
SpiderMonkey, or any other conforming browser that also supports de-facto
__proto__.
Note that the mitigating practice I just recommended: always saying
array[+i] rather than array[i], would have prevented this attack as well,
even though I had not thought of it before.
--
Cheers,
--MarkM
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
