Skip to content
This repository has been archived by the owner on Feb 1, 2025. It is now read-only.

Simplify reference to the global object #292

Merged
merged 1 commit into from
Jul 23, 2017

Conversation

maxnordlund
Copy link
Contributor

Take advantage of sloppy mode, aka non-strict mode, where unbound functions are called with the global object as this.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode#Securing_JavaScript

@benjamn
Copy link
Contributor

benjamn commented Apr 28, 2017

See also: #112

It's good that this doesn't use Function (for CSP reasons), but It seems like this could fail if the runtime is embedded in a bundle of strict code?

@benjamn
Copy link
Contributor

benjamn commented Apr 28, 2017

What about this?

(function(){return this}()) || Function("return this")()

This avoids using the Function constructor unless absolutely necessary, but still allows the developer to avoid the CSP violation of using the Function constructor.

typeof global === "object" ? global :
typeof window === "object" ? window :
typeof self === "object" ? self : this;
var g = (function { return this })();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An anonymous and parameter-less function?? Think you need a (), as the tests will surely tell you.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow, I guess none of the tests use runtime-module.js, huh.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Darn it, knew I forgot something. I'll fix it right away.

@maxnordlund
Copy link
Contributor Author

Yeah, the strict code thing is real. But it should be safe as long as you don't blindly concatenate all your JS together with the "use strict"; at the top, as amazon did by mistake.

I think most, if not all, users of this library uses a bundler, which I hope uses a function closure to keep things separate. Then it's fine if something else is using top level strict mode.

What about this?

(function(){return this}()) || Function("return this")()

That looks like the ticket. I'll get it in, and fix the other thing you pointed out.

Take advantage of sloppy mode, aka non-strict mode, where unbound
functions are called with the global object as `this`.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Strict_mode#Securing_JavaScript
@maxnordlund
Copy link
Contributor Author

I'm implemented that fix, and squashed the commits while I was at it.

@benjamn benjamn merged commit b0522b2 into facebook:master Jul 23, 2017
@benjamn
Copy link
Contributor

benjamn commented Jul 23, 2017

Thanks for working on this, and sorry it sat unmerged for so long!

@maxnordlund maxnordlund deleted the patch-1 branch July 23, 2017 18:49
@maxnordlund
Copy link
Contributor Author

No worries, life happens.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants