__proto__ security

Andreas Rossberg rossberg at google.com
Mon Feb 13 09:38:06 PST 2012


On 12 February 2012 23:47, Brendan Eich <brendan at mozilla.org> wrote:
> The concern (no trolling here) is at least about attack surface. If there's
> no setter that can be extracted, there's no need for the "frame check"
> (however phrased). Adding that check adds more machinery to get wrong or
> have interact in unexpected ways with other moving parts.

One could also make the proto accessor special in that reflecting it
does only return a poisoned pair of getter/setters. Doesn't seem more
magic or hacky than pretending that it is a data property. :)

/Andreas


More information about the es-discuss mailing list