4 ms·
You can hijack toString, sure. You can also hijack other things. https://www.w3.org/Bugs/Public/show_bug.cgi?id=25345#c5 https://www.w3.org/Bugs/Public/show_b
by bzbarsky 10y ago
You can hijack toString, sure.
You can also hijack other things. https://www.w3.org/Bugs/Public/show_bug.cgi?id=25345#c5 https://www.w3.org/Bugs/Public/show_bug.cgi?id=25345#c5 is a good example of how this can play out in an actual example of code using getRandomBytes and then doing something with the return value.
As I said there, the only principled solution here is something like Caja, where you freeze all the primordials up front and then run all the maybe-untrusted code in sandbox-like setups. Well, or not having XSS injection, of course...