3 ms·

How is this different from monkeypatching in e.g. Python, Ruby?

• dragonwriter 6y ago
  > How is this different from monkeypatching in e.g. Python, Ruby? It’s not monkeypatching, its a class of vilnerabilities that allow an attacker to do the monkeypatching, and to do so to the root Object. Key things about JavaScript that differ from Ruby/Python relevant to it are: (1) Prototype-based inheritance, (2) Syntax and common idioms thar support and encourage use of plain objects where Ruby/Python would use string-keyed Hash/dict instances (equivalent to JS Map), including when objects are constructed from untrusted JSON (which, again, Ruby/Python would serialize to Hash/dict, not exposing member properties ot manipulation). What would be reading a Hash/dict keyvalue pair from an untrusted source in Ruby or Python (not, generally, risky) can easily be, in JavaScript, opening a gateway to potentiallt inject data members to the shared prototype of all objects.