Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Real-world examples from Node.js #5

Closed
js-choi opened this issue Sep 20, 2021 · 3 comments · Fixed by #7
Closed

Real-world examples from Node.js #5

js-choi opened this issue Sep 20, 2021 · 3 comments · Fixed by #7
Labels
documentation Improvements or additions to documentation help wanted Extra attention is needed

Comments

@js-choi
Copy link
Collaborator

js-choi commented Sep 20, 2021

I am seeking real-world examples of code that would be improved by a syntactic this-bind operator.

According to @ljharb and @bmeck, Node contains many methods that bind various intrinsic global methods in order to avoid being affected by external prototype pollution. @bmeck gives this example in tc39/proposal-extensions#11:

// instead of
const slice = Function.prototype.call.bind(Array.prototype.slice);

function copyArray(arr) {
  return slice(arr);
}

// The adversary’s external code.
delete Array.prototype.slice;
delete Function.prototype.call;

// Our own trusted code, running later.
// In spite of the adversary’s code, this does not throw an error.
copyArray(arr);

…which in this proposal would be improved to:

// Our own trusted code, running before any adversary.
const { slice } = Array.prototype;

function copyArray(arr) {
  return arr->slice();
}

// The adversary’s external code.
delete Array.prototype.slice;
delete Function.prototype.call;

// Our own trusted code, running later.
// In spite of the external code, this does not throw an error.
copyArray(arr);

Where in Node.js (or elsewhere) does this pattern actually occur? We need to transplant examples from them into the explainer.

@js-choi js-choi added documentation Improvements or additions to documentation help wanted Extra attention is needed labels Sep 20, 2021
@ljharb
Copy link
Member

ljharb commented Sep 21, 2021

Any part of node that uses the "primordials" pattern pulls in, for example, ArrayPrototypeSlice.

With this proposal, it could name that slice, and then do arr->slice(x, y) instead of what it does now: ArrayPrototypeSlice(arr, x, y).

@bmeck
Copy link
Member

bmeck commented Sep 21, 2021

I'd note that primordials in node do sometimes do much more than just uncurry the this value so it wouldn't remove the need for primordials entirely, just most of the prototype methods.

@js-choi
Copy link
Collaborator Author

js-choi commented Sep 30, 2021

For future reference: nodejs/node#30697 and lib/internal/per_context/primordials.js.

js-choi added a commit that referenced this issue Sep 30, 2021
@js-choi js-choi mentioned this issue Sep 30, 2021
js-choi added a commit that referenced this issue Sep 30, 2021
* explainer/spec: Rename to bind-this operator
* explainer: Clarify property-accessor non-goal
* explainer § Description: Reword, note Function.call equivalence
* explainer § Description: Improve precedence table
* explainer: Node.js real-world examples
* explainer § Description: Fix inconsistent RHS
See #7 (comment).

Closes #5.

Co-authored-by: Jordan Harband <ljharb@gmail.com>
Co-authored-by: Bradley Farias <bradley.meck@gmail.com>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 12, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
documentation Improvements or additions to documentation help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants