Side navigation
#14552 closed feature (notabug)
Opened November 16, 2013 12:25AM UTC
Closed November 16, 2013 06:00PM UTC
Store the context of a proxy as an attribute on the proxy object.
Reported by: | jdfreder@calpoly.edu | Owned by: | jdfreder@calpoly.edu |
---|---|---|---|
Priority: | undecided | Milestone: | None |
Component: | unfiled | Version: | 1.10.2 |
Keywords: | Cc: | ||
Blocked by: | Blocking: |
Description
PR 1438 (https://github.com/jquery/jquery/pull/1438) stores the context
of a proxied function as an attribute on the resultant proxy. The following shows why this is convinient:
```javascript
a = $.proxy(myFunction, myContext)
```
The context cannot be determined from a
in *master*. With PR 1438 (https://github.com/jquery/jquery/pull/1438) the context can now be determined by
```javascript
a.context
```
Attachments (0)
Change History (5)
Changed November 16, 2013 02:37AM UTC by comment:1
owner: | → jdfreder@calpoly.edu |
---|---|
status: | new → pending |
Changed November 16, 2013 04:56AM UTC by comment:2
Hi dmethvin,
In my specific use case, a dictionary exists containing a list of callbacks (all proxies) that fill specific elements with content. The dictionary maps content id's to each callback. Elsewhere in the code (a recent addition) a content id exists for which I need an element. Using the dictionary I can get the callback to fill the element, but I need a handle to the element itself.
Your suggestion would definitely work, but for now I've implemented a different mechanism for mapping content id's to elements. I still think this would be a useful addition to jQuery.
Changed November 16, 2013 04:57AM UTC by comment:3
Hi dmethvin,
In my specific use case, a dictionary exists containing a list of callbacks (all proxies) that fill specific elements with content. The dictionary maps content id's to each callback. Elsewhere in the code (a recent addition) a content id exists for which I need an element. Using the dictionary I can get the callback to fill the element, but I need a handle to the element itself.
Your suggestion would definitely work, but for now I've implemented a different mechanism for mapping content id's to elements. I still think this would be a useful addition to jQuery.
Changed November 16, 2013 05:43PM UTC by comment:4
This creates a side channel—any code that can reach this .context
property can also maliciously modify any writable or configurable properties, which in turn allows access to potentially sensitive references that would otherwise be out of reach.
Changed November 16, 2013 06:00PM UTC by comment:5
resolution: | → notabug |
---|---|
status: | pending → closed |
Well in this case, the patch is only saving the .context
as a property of the proxy but it is still using the original closure variable in the call.
Putting the context on the object, even if it can't be modified, doesn't seem like a good idea if it would leak information not generally needed by the caller. If the creator of the proxy wants to share the context it can certainly do so by adding the property to the object after creating it.
What is the use case for this? Obviously you already get the context in a call. If you did need it, you could assign it as a property to the returned proxy object since you passed it in.