On 3/11/2013 12:41 PM, Kevin Reid wrote:
On Sat, Mar 9, 2013 at 10:13 AM, Andrea Giammarchi
<[email protected] <mailto:[email protected]>> wrote:
Yes, taking care of all those things is necessary as well. ES5
provides us the tools to do so: Object.freeze(). If you recursively
freeze all standard global objects then all of the issues you mention
are handled. Secure ECMAScript (SES), developed by Mark Miller, does
this; it provides an execution environment which _is_ secure (given a
sufficiently conformant ES5 implementation).
I would note, however, that it looks like at, least in browsers,
freezing the window or even any single property on it will no longer be
an option in the future. I believe the technique used by SES (correct me
if I'm wrong) is using is more complex than simply freezing the window
(though I believe it does freeze every property recursively from there).
Something like shadowing all whitelisted global names and preventing any
kind of direct access to the window object at all. This requires some
amount of source code sandboxing to accomplish.
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
