Re: defineProperty is a blacklist

On 14 February 2011 08:49, sird@rckc.at <sird@rckc.at> wrote:

> Right, from a worker you can nuke away XHR and importScript. It's fairly
> smaller than a normal window :)
>

On Firefox yes but Chrome seems to retain XHR when deleting, bug? Then you
have __proto__, self etc


> It's not a whitelist, but given that you get a smaller surface, you are not
> in so much danger right?
>

You are in no danger with a whitelist, this is my point but a browser can
always add a new Object that you did not protect