__proto__ security
Geoffrey Sneddon
gsneddon at opera.com
Sat Feb 25 16:23:39 PST 2012
On 13/02/12 17:55, Allen Wirfs-Brock wrote:
> Let's try to get this back to concrete issues that I can incorporate into a specification.
>
> The current draft is at http://wiki.ecmascript.org/lib/exe/fetch.php?id=strawman%3Amagic_proto_property&cache=cache&media=harmony:draft_proto_spec_rev2.pdf
>
> Gavin and Oliver seem to really want to use an accessor for Object.prototype.__proto__
On the whole this is my preference too, as it practically eliminates
special-casing for the __proto__ property, which on the whole I'm in
favour of.
I've basically implemented something close to what is attributed to Dave
Herman on the wiki in Carakan now, albeit without the context check,
though I agree it's a good idea. I wonder if it's web-compatible to
disallow cross-context prototype chains (both through __proto__ and
Object.create).
> Brendan has expressed a willingness to accepting under specify some the Object.prototype.__proto__ property in ways that we normally wouldn't for mandatory parts of the specification.
>
> I could accommodate these two perspective by changing the first paragraph of the draft B.3.1.1 to read:
>
> The __proto__ property of the Object prototype property initially has the attributes {[[Enumerable]]: false, [[Configurable]]: true}. The state of other attributes and whether it is an accessor or data property is implementation defined.
>
> This would allow implementations to use either a data property or a access property for Object.prototype.__proto__. However, the internal method extensions are still needed in order to define the semantics in a manner that allows either implementation approach to be used.
I'm with Mark on this: I'd much rather see there be (rough) consensus on
this than divergent implementations.
The one thing I would prefer, however, would be that the setter is
optional (i.e., it is permissible to have __proto__ have just a getter
or have both a getter and a setter, but not just a setter).
--
Geoffrey Sneddon — Opera Software
<http://gsnedders.com>
<http://opera.com>
More information about the es-discuss
mailing list