Having a non-enumerable Array.prototype.contains may not be web-compatible

Andrea Giammarchi andrea.giammarchi at gmail.com
Tue Sep 30 15:35:14 PDT 2014


I'm personally against unmaintained code and/or websites but here it's not
ES7 breaking the web, it's a library already broken (somehow) due native
prototype pollution without a mechanism to prevent these, apparently
historically known, problems.

Should ES7 be planned around all methods already taken in there? I don't
think so + it is also already patched and it's also a small fix.

If sites and developers have no reason to update code 'cause ES7 cannot
release until they'll change a file ... why would they anyway.

Best Regards

On Tue, Sep 30, 2014 at 9:02 PM, Oliver Hunt <oliver at apple.com> wrote:

> The problem is not people actively developing it, or creating new content
> with it.  The problem is _existing_ content that might break. All libraries
> have periods where they are in vogue, and then fade out leaving detritus
> that hangs around for years/decades on major sites.
>
> --Oliver
>
>
>
> On Sep 30, 2014, at 12:45 PM, Andrea Giammarchi <
> andrea.giammarchi at gmail.com> wrote:
>
> "the current state of the web" ... with all due respect for that library,
> it's been years since I've heard anything about it.
>
> It's also common on the old web to loop over Arrays via `for/in` to avoid
> checks for sparse indexes through the entire length ... so making anything
> enumerable in that native prototype would break something else too form
> days where `getOwnPropertyNames` was unknown.
>
> long story short: I definitively +1 what Michał Wadas already said, it's
> already patched and people must update software anyway due security
> problems, **patches**, etc etc.
>
> just my .02
>
>
>
> On Tue, Sep 30, 2014 at 8:18 PM, Boris Zbarsky <bzbarsky at mit.edu> wrote:
>
>> On 9/30/14, 2:45 PM, Michał Wadas wrote:
>>
>>> Bug in MooTools is not a reason to make any method of Array.prototype
>>> enumerable.
>>>
>>
>> I didn't say we need to make it enumerable.
>>
>> I said that given the current state of the web, a web browser cannot ship
>> a non-enumerable method named "contains" on Array.prototype.
>>
>> The options, therefore, are:
>>
>> 1)  Make the method enumerable.
>> 2)  Name the method something else.
>> 3)  Don't ship the method until every site that currently uses the
>>     buggy versions of MooTools (which is every site that uses
>>     MooTools, since they only fixed it 4 days ago).
>>
>> I'm perfectly fine with option 3, personally.  Note that in practice that
>> likely means "never ship it" unless people make some sort of concerted
>> effort to get sites to update their MooTools version.
>>
>> -Boris
>>
>> P.S. It may be worth avoiding the method names mootools sets up but
>> doesn't force-copy in the future.  Even better would be getting them to fix
>> their code so there are no such method names, of course.
>>
>> _______________________________________________
>> es-discuss mailing list
>> es-discuss at mozilla.org
>> https://mail.mozilla.org/listinfo/es-discuss
>>
>
> _______________________________________________
> es-discuss mailing list
> es-discuss at mozilla.org
> https://mail.mozilla.org/listinfo/es-discuss
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20140930/6bc7b7ba/attachment-0001.html>


More information about the es-discuss mailing list