Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent access of protected props with prototype manipulation #6

Open
trusktr opened this issue Nov 19, 2018 · 1 comment
Open

Prevent access of protected props with prototype manipulation #6

trusktr opened this issue Nov 19, 2018 · 1 comment

Comments

@trusktr
Copy link
Owner

trusktr commented Nov 19, 2018

The following example from tc39/ecma262#1341 (comment) shows a way to gain access to the protected members due to having access to the instance's class via the .constructor prop:

const T = Class(({ Protected }) => class {
  constructor() {
    Protected(this).v = 'T';
  }
});

const t = new T();

function extractTheDeets(V) {
  const S = Class(({ Protected }) => class extends V.constructor {
    constructor() {
      super();
      const original = Object.getPrototypeOf(V);
      Object.setPrototypeOf(V, S.prototype);
      const p = Protected(V);
      Object.setPrototypeOf(V, original);
      return p;
    }
  });
  return new S();
}

extractTheDeets(t);

It only works with Protected, not Private.

We can prevent it with a simple monkey patch of the Object.get/setPrototypeOf or __proto__ descriptors. Is there another way?

We could also delete the .constructor prop and provide a Static helper for accessing static members without revealing the class constructor. Does anyone ever need the .constructor prop for anything other than accessing static members?


Another example (using infamous):

const scene = document.querySelector('i-scene')

const Test = infamous.Class('Test').extends(infamous.Scene, ({ Protected }) => ({
	constructor() {
		debugger
		const proto = scene.__proto__
		scene.__proto__ = Test.prototype
		console.log(Protected(scene)._props)
		scene.__proto__ = proto
	},
}))

new Test
@trusktr trusktr changed the title Prevent access of protected props by inheriting from publicInstance.constructor. Prevent access of protected props in the following example Nov 19, 2018
@trusktr
Copy link
Owner Author

trusktr commented Apr 15, 2019

We can prevent prototype from being modified with lockPrototype, which would prevent the unauthorized public access of the protected members in @devsnek's example.

@trusktr trusktr changed the title Prevent access of protected props in the following example Prevent access of protected props with prototype manipulation Apr 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant