Re: Proxy target/handler access leak in Node

2018-09-16 Thread Isiah Meadows
In the browser, I could see why not to allow it by default: it's a potential security hole, and GC concerns do exist (what happens if the symbol's data is no longer accessible without reflection?). In embeddings, I'm not sure if there's any real problem, considering Node's `vm` API allows proper

Re: Proxy target/handler access leak in Node

2018-09-16 Thread Darien Valentine
> What is going on here? Can you explain? A C++/V8 API is used to obtain references to the target and handler from only the proxy object, even though those objects aren’t supposed to be available to this ES scope: https://github.com/nodejs/node/blob/master/lib/util.js#L642-L647 The pair of

Re: stable sort proposal

2018-09-16 Thread 森建
It seems like stable sort will be discussed in the 66th meeting of TC39. I hope for good news! https://github.com/tc39/agendas/blob/master/2018/09.md#agenda-items On 2018/09/12 12:02, kai zhu wrote: +1 it would avoid stable-sort workarounds like this [1], [2] for javascript-database

Re: Proxy target/handler access leak in Node

2018-09-16 Thread Mark Miller
This is indeed quite scary. I have never used of explored the Node `util` API. What is going on here? Can you explain? The Realms shim and SES (which build on the Realms shim) create an environment in which only those globals defined by EcmaScript, not by the host, are present by default.

Re: Proxy target/handler access leak in Node

2018-09-16 Thread Mike Samuel
Nicely done! One more reason to prefer WeakMaps to properties when relating objects and secrets. On Sun, Sep 16, 2018 at 2:59 PM Darien Valentine wrote: > A few weeks ago I’d commented on an open Node github issue regarding > Proxies and inspection. While the bulk of the comment concerns an

Proxy target/handler access leak in Node

2018-09-16 Thread Darien Valentine
A few weeks ago I’d commented on an open Node github issue regarding Proxies and inspection. While the bulk of the comment concerns an opinion that proxies should not be treated as special case, I included an example of a mechanism by which the current implementation allows outside code to access