W3C home > Mailing lists > Public > public-script-coord@w3.org > April to June 2014

Re: WindowProxy as the key in ES6 Set/Map/WeakSet/WeakMap

From: Toon Verwaest <verwaest@chromium.org>
Date: Wed, 16 Apr 2014 09:16:10 +0200
Message-ID: <CANS-YRpqr-b_zKf08Ucv025Vzz5UKeXJx0eoj+ncbUW9Vf41Qg@mail.gmail.com>
To: Adam Barth <abarth@chromium.org>
Cc: Rick Waldron <waldron.rick@gmail.com>, Boris Zbarsky <bzbarsky@mit.edu>, Adam Klein <adamk@chromium.org>, "Mark S. Miller" <erights@google.com>, "public-script-coord@w3.org" <public-script-coord@w3.org>
>> From a use cases perspective, there is one issue: how does one attach
state to a "web page"?
> That's a slippery notion because sometimes |w| acts like the container
and sometimes it acts like the thing contained.  Sounds like a recipe for
security vulnerabilities when the author and WeakMap disagree about whether
they're talking about the container or the thing contained...

If you want to associate state with a proxy, use a WeakMap.

If you want to attach state to a specific window with all security checks,
install a private symbol on the window itself. (Granted, this does not
exist yet :-)).
Received on Wednesday, 16 April 2014 13:03:03 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 17:14:21 UTC