archives

« Bugzilla Issues Index

#3472 — 19.1.3.6 Object.prototype.toString: Possible to detect proxied array objects


19.1.3.6 Object.prototype.toString ( )

Object.prototype.toString possibly needs to use IsArray, otherwise it can be (ab-)used to detect proxied array objects, because it's not possible for proxied array objects to use the tag "Array".




---
js> p = new Proxy([], {
get(t,pk,r){
if(pk === Symbol.toStringTag) return "Array";
return Reflect.get(t,pk,r)
}})
{}
js> Array.isArray(p)
true
js> Object.prototype.toString.call(p)
"[object ~Array]"
---


Mark/Tom are you ok if we make this change? I don't really like it, as it allows a Proxy that expose no array behavior to still claim to be a built-in Array. But give that we agreed to make Array.isArray work in this manner I don't see why we wouldn't also do it for O.p.toString.


Yes, I think that is the most consistent thing to do.


fixed in rev30 editor's draft


+1


fixed in rev30