4 ms·
I guess I have a hard time seeing how Object.freeze() protects against malicious code, when any malicious script can still access the global object? I can under
by goto11 4y ago
I guess I have a hard time seeing how Object.freeze() protects against malicious code, when any malicious script can still access the global object? I can understand something like the "Shadow realms" proposal, where a modules access to global objects can be constrained.
- kragen 4y agoIn things like Jessie or ADsafe, confined scripts are screened to ensure that they do not access the global object.
- goto11 4y agoSo am I correct in the understanding that Object.freeze in JavaScript does not provide any useful protection against malicious code? But in a different language, or a hypothetical future version of JavaScript, it might play a role in such a protection?
- kragen 4y agoI think it provides, at best, very limited useful protection against malicious code that has access to the whole JS language, but it means that Jessie can include enormously more of JS than ADsafe did.
- cztomsik 4y agoShadowRealm + Object.freeze() could be enough to create safe env for untrusted code.