On Wed, Apr 29, 2015 at 2:07 PM, Mark S. Miller <erig...@google.com> wrote:
> Hi Scott, I think your approach is on the right track. How about the
> following?
>
> Anyone see a way to attack it?
>
>
>
> const goodPromises = new WeakSet();
> class DefensivePromise {
> constructor(x) {
> super(x);
> if (new.target === DefensivePromise) {
> Object.freeze(this);
> goodPromises.add(this);
> }
> }
> static resolve(x) {
> if (goodPromises.has(x)) {
> return x; // should be equiv to super.resolve(x);
> }
> return new DefensivePromise(r => {r(x)});
> }
> }
>
Assuming that you don't export DefensivePromise to the attacker, this is
fine. Otherwise, I think this is still vulnerable to Reflect.construct
lying about new.target:
```
class BadPromise extends DefensivePromise {
then(r) { r(); r(); }
}
var bp = Reflect.construct(BadPromise, DefensivePromise);
```
Since it's `Promise.then` you care about, I think the approach in my
previous message (where `then` is tested directly) is preferable.
--scott
_______________________________________________
es-discuss mailing list
es-discuss@mozilla.org
https://mail.mozilla.org/listinfo/es-discuss
