Re: [whatwg/dom] [Proposal] Add EventTarget.getEventListeners() (#412)

I don't think you can exploit a function string representation or its reference in JS so I am not sure I am following. Having malicious scripts able to retrieve listeners is a violation of the current standard where listeners should never leak and securing the env is trivial enough for early/top-most scripts so that nothing can poison prototypes down the road (including function call/apply).

So, maybe security is no the best term, but it's a concern.

> While non-trivial to exploit, programs that run in the same physical process cannot meaningfully keep secrets from each other.

I guess private fields were added for no reason then? I am not sure where this is going 🤔

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/dom/issues/412#issuecomment-1062984902

You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/dom/issues/412/1062984902@github.com>