Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-20 Thread Yang Guo
Sounds like defining your own Array.prototype.forEach would solve the problem. Yang On Friday, March 15, 2013 9:07:35 PM UTC+1, Benjamin Kalman wrote: On Fri, Mar 15, 2013 at 1:06 PM, Joshua Bell jsb...@chromium.orgjavascript: wrote: *If* you know your scripts will run first and *if* it

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-15 Thread Joshua Bell
*If* you know your scripts will run first and *if* it is acceptable to deny external scripts the ability to modify built-ins, you could consider using SES. https://code.google.com/p/es-lab/wiki/SecureEcmaScript On Wed, Mar 13, 2013 at 9:32 AM, Benjamin Kalman kal...@chromium.orgwrote: On

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-15 Thread Benjamin Kalman
On Fri, Mar 15, 2013 at 1:06 PM, Joshua Bell jsb...@chromium.org wrote: *If* you know your scripts will run first and *if* it is acceptable to deny external scripts the ability to modify built-ins, you could consider using SES. https://code.google.com/p/es-lab/wiki/SecureEcmaScript Neither

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Jakob Kummerow
On Tue, Mar 12, 2013 at 11:56 PM, Benjamin Kalman kal...@chromium.orgwrote: I'm on the Chrome Extensions team, and we've run into a problem where extensions override Array.prototype.forEach in a way that breaks our internal JS. A workaround we've done is to write our own forEach method, but

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Chris Angelico
On Wed, Mar 13, 2013 at 9:01 PM, Jakob Kummerow jkumme...@chromium.org wrote: The general problem with introducing sanity, however, is that you can't break existing code, which basically means that all the good stuff has to be opt-in, which in turn means that the original problem doesn't just

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Toon Verwaest
Once we have proper symbol (private names) support, you could use that to make your own internal API. On Wed, Mar 13, 2013 at 2:56 PM, Michael Schwartz myk...@gmail.com wrote: Can Harmony Proxies be used to detect when the prototypes or builtins are being overridden? If so, you could save

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Andreas Rossberg
On 13 March 2013 14:56, Michael Schwartz myk...@gmail.com wrote: Can Harmony Proxies be used to detect when the prototypes or builtins are being overridden? If so, you could save the original and provide a new API to fetch the original. I don't see how proxies help here. Saving the originals

RE: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread jokoswt
Thank you. -- pesan asli -- Subjek: Re: [v8-users] Best way to protect against external JS affecting internal JS Dari: Toon Verwaest verwa...@chromium.org Tanggal: 13-03-2013 21.23 Once we have proper symbol (private names) support, you could use that to make your own internal API. On Wed

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Michael Schwartz
On Mar 13, 2013, at 7:27 AM, Andreas Rossberg rossb...@google.com wrote: On 13 March 2013 14:56, Michael Schwartz myk...@gmail.com wrote: Can Harmony Proxies be used to detect when the prototypes or builtins are being overridden? If so, you could save the original and provide a new API to

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Andreas Rossberg
On 13 March 2013 15:49, Michael Schwartz myk...@gmail.com wrote: On Mar 13, 2013, at 7:27 AM, Andreas Rossberg rossb...@google.com wrote: On 13 March 2013 14:56, Michael Schwartz myk...@gmail.com wrote: Can Harmony Proxies be used to detect when the prototypes or builtins are being

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Benjamin Kalman
Thanks for the responses, very interesting. On Wed, Mar 13, 2013 at 3:01 AM, Jakob Kummerow jkumme...@chromium.orgwrote: Welcome to JavaScript! Have you considered using a language with a sane specification? Well, the other option is to try to write everything through the v8 API, which would

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Michael Schwartz
A Harmony Proxy looks like an object. When ANY member is accessed, you have a function called that returns (or sets) the value. Sort of like a wildcard getter and setter for the object in question. There was mention a while ago about being able to proxy for the global or window object. I am

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Jakob Kummerow
On Wed, Mar 13, 2013 at 4:44 PM, Benjamin Kalman kal...@chromium.orgwrote: Not really feasible, monkey patching is an idiom that JS developers would get very upset about being taken away from them. Plus lots of libraries do it. We had a hard enough problem (and in fact failed) forbidding eval.

Re: [v8-users] Best way to protect against external JS affecting internal JS

2013-03-13 Thread Benjamin Kalman
On Wed, Mar 13, 2013 at 9:07 AM, Jakob Kummerow jkumme...@chromium.orgwrote: Well, but too hard to implement is not the reason. You're not asking how you can implement monkey-patching; you're asking how you can stop/limit/blacklist/undo/circumvent it because it's harmful. The way I see it,