archives

« Bugzilla Issues Index

#1446 — 15.3.4.7: writable+configurable Function.prototype[@@hasInstance] can reveal [[BoundTarget]]


Function.prototype[@@hasInstance] is currently writable+configurable, re-defining Function.prototype[@@hasInstance] thus makes it possible to reveal the [[BoundTarget]] internal data property of bound functions.

Simple example using `Intl.Collator.prototype.compare` which returns a bound function, the internal "compare" function should not be revealed to the user.

> js> oldHasInstance = Function.prototype[getSym("@@hasInstance")]
> function @@hasInstance() { /* native code */ }
> js> Function.prototype[getSym("@@hasInstance")] = function(v){ print("@@hasInstance: "+this); return oldHasInstance.call(this, v) }
> function(v){ print("@@hasInstance: "+this); return oldHasInstance.call(this, v) }
> js> [] instanceof Intl.Collator.prototype.compare
> @@hasInstance: function BoundFunction() { /* native code */ }
> @@hasInstance: function compare() { /* native code */ }


Ok, I'll make Function.prototype[@@hasInstance]] non-writable and non-configurable.

fixed in rev 15 editor's draft


resolved in rev 15, May 14, 2013 draft