On Monday, December 31, 2012, Tom Van Cutsem wrote: > > That said, I think this issue is orthogonal to our choice of whether or > not to expose "setPrototypeOf" as part of the MOP. Even if we do expose > it, any sandbox that wants to take away the ability the set the prototype > can simply poison Reflect.setPrototypeOf in addition to deleting > Object.prototype.__proto__. >
Ive realized this is actually a potentially serious flaw with the module system with regards to how the builtin modules expose features. If you introduce Reflect.setPrototypeOf (or more generally, anything exposed as an export of a system module) there is no way for something like SES (user level) to remove access to it. There's no way to monkey patch these things or remove them or add new features to them because the modules aren't externally mutable. `delete Reflect.setPrototypeOf` is not currently an option.
_______________________________________________ es-discuss mailing list [email protected] https://mail.mozilla.org/listinfo/es-discuss
