2016-02-16 15:51 GMT+01:00 Coroutines <[email protected]>:
> Having the ability to derive from "global" (only in Node) and
> prepare an Object to run an function within as its global context
> would be an invaluable ability. (imo)
>
It seems like an obvious idea, but in fact it's almost impossible to secure
- consider `true.constructor.constructor("alert('XSS')")()`
ECMAScript lacks secure sandbox that would work in every browser, but such
limited scope manipulation is totally useless as "secure sandbox".
BTW, such limited scope manipulation is already possible, see how my
library works there -
https://github.com/Ginden/reflect-helpers/blob/master/tests/closures.js#L14
(it heavily uses `eval`).
Sending again because of wrong "to".
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
