Re: Fwd: Draft Proposed Standard SES (Secure EcmaScript)
"Mark S. Miller" <[email protected]> Fri, 18 Mar 2016 20:44:15 -0700
| Newsgroups | gmane.comp.capabilities.general |
|---|---|
| Message-ID | <CABHxS9h2VJxJcju0_DtYpT5869Axyo1g6DZiFUd7c1uG7ze4iw@mail.gmail.com> |
--===============3775904308064700481== Content-Type: multipart/alternative; boundary=001a11442ef87b80d3052e5ead7d --001a11442ef87b80d3052e5ead7d Content-Type: text/plain; charset=UTF-8 On Fri, Mar 18, 2016 at 6:34 PM, David Nicol <[email protected]> wrote: > I hope the following makes sense, it is imprecise > > > > > I have a question. Does SES entirely do away with the "scope chain" and > all passing by shared visibility, trading that for explicit object members, > or are lexical scopes still available? > Lexical scopes are still exactly as available as they are otherwise. SES does nothing whatsoever to change that. Historically, one of the many things that motivated me to fight so hard to get true lexical scoping into ES5/strict was that the SES-shim needed it. But now that we have it, SES does nothing to change it. > > If lexical scopes are still available, can the global symbols, that > represent immutables, get assigned new representations? That is, can core > features get turned off after we're done using them, like > > function = function(x){ throw }; // we have all the functions we > need, further attempts to compile more will fail. > I don't understand the question. "function" is a keyword. It cannot be used as a variable name. > > Can the immutables be lexically hidden? > Good question. Yes and no. You can hide the original global name bindings by several means. The fresh global of a new ses realm is a plain mutable object. It initially inherits from the proto-global, but you can change that. To have full control, you can put what you want on the global and then do "freshGlobal.__proto__ = null" (or use Reflect.setPrototypeOf). By wrapping any code you execute in a prelude and postlude that shadows globals and hides the global object itself, you can also change the bindings of these names. However, this does not enable you to deny access to the intrinsics that can be reached by syntax. For example, the expression "[]" in any SES realm will create an array that initially inherits from the proto-SES realm's Array.prototype, independent of the scoping environment in which that code executes. That's why we require everything in the proto-SES realm to be transitively immutable and powerless. We assume these objects cannot be denied. Of course, a code rewriting strategy can change what is reachable by syntax. But SES does nothing to either help or hurt rewrite-based enforcement. > By allowing hiding, you might be able to avoid having to construct a new > eval function with each realm unless you really need one. That is, > leave "eval" out of the core language, and put in its place > evalFactory(topRealm), with > > > var eval = evalFactory(immutableGlobal); > // or even better > eval = function(dummySrc) { throw } // not sure how to spell this > > as an available compatability shim > > so eval, when needed, could get clobbered with whatever realm you want the > evalling to happen in, instead of requiring all realms, even realms that > aren't planning on evalling anything, to have one. > I'm sorry, I don't understand the suggestion. What does evalFactory do? > > > >> It is now ready for comments at https://github.com/FUDCo/ses-realm >> > > > > > -- > A circular pizza with radius Z and thickness A has a volume of PI (Z*Z) A > > _______________________________________________ > cap-talk mailing list > [email protected] > http://www.eros-os.org/mailman/listinfo/cap-talk > > -- Cheers, --MarkM --001a11442ef87b80d3052e5ead7d Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On F= ri, Mar 18, 2016 at 6:34 PM, David Nicol <span dir=3D"ltr"><<a href=3D"m= ailto:[email protected]" target=3D"_blank">[email protected]</a>><= /span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8= ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div>I hop= e the following makes sense, it is imprecise</div><div><br></div><div><br><= /div><div><br></div><br><div>I have a question. Does SES entirely do away w= ith the "scope chain" and all passing by shared visibility, tradi= ng that for explicit object members, or are lexical scopes still available?= </div></div></blockquote><div><br></div><div>Lexical scopes are still exact= ly as available as they are otherwise. SES does nothing whatsoever to chang= e that. Historically, one of the many things that motivated me to fight so = hard to get true lexical scoping into ES5/strict was that the SES-shim need= ed it. But now that we have it, SES does nothing to change it.</div><div><b= r></div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:= 0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><d= iv><br></div><div>If lexical scopes are still available, can the global sym= bols, that represent immutables, get assigned new representations? That is,= can core features get turned off after we're done using them, like</di= v><div><br></div><div>=C2=A0 =C2=A0 =C2=A0 function =3D function(x){ throw = }; // we have all the functions we need, further attempts to compile more w= ill fail.</div></div></blockquote><div><br></div><div>I don't understan= d the question. "function" is a keyword. It cannot be used as a v= ariable name.</div><div><br></div><div>=C2=A0</div><blockquote class=3D"gma= il_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-lef= t:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quot= e"><br></div><div class=3D"gmail_quote">Can the immutables be lexically hid= den?</div></div></div></blockquote><div><br></div><div>Good question. Yes a= nd no.=C2=A0</div><div><br></div><div>You can hide the original global name= bindings by several means. The fresh global of a new ses realm is a plain = mutable object. It initially inherits from the proto-global, but you can ch= ange that. To have full control, you can put what you want on the global an= d then do "freshGlobal.__proto__ =3D null" (or use Reflect.setPro= totypeOf). By wrapping any code you execute in a prelude and postlude that = shadows globals and hides the global object itself, you can also change the= bindings of these names.</div><div><br></div><div>However, this does not e= nable you to deny access to the intrinsics that can be reached by syntax. F= or example, the expression "[]" in any SES realm will create an a= rray that initially inherits from the proto-SES realm's Array.prototype= , independent of the scoping environment in which that code executes. That&= #39;s why we require everything in the proto-SES realm to be transitively i= mmutable and powerless. We assume these objects cannot be denied.</div><div= ><br></div><div>Of course, a code rewriting strategy can change what is rea= chable by syntax. But SES does nothing to either help or hurt rewrite-based= enforcement.</div><div><br></div><div>=C2=A0</div><blockquote class=3D"gma= il_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-lef= t:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quot= e"> By allowing hiding, you might be able to avoid having to construct a ne= w eval function with each realm unless you really need one. That is,</div><= div class=3D"gmail_quote">leave "eval" out of the core language, = and put in its place evalFactory(topRealm), with</div><div class=3D"gmail_q= uote"><br></div><div class=3D"gmail_quote"><br></div><div class=3D"gmail_qu= ote">=C2=A0 =C2=A0 var eval =3D evalFactory(immutableGlobal);</div><div cla= ss=3D"gmail_quote">=C2=A0 =C2=A0 // or even better</div><div class=3D"gmail= _quote">=C2=A0 =C2=A0 eval =3D function(dummySrc) { throw } // not sure how= to spell this</div><div class=3D"gmail_quote"><br></div><div class=3D"gmai= l_quote">as an available compatability shim</div><div class=3D"gmail_quote"= ><br></div><div class=3D"gmail_quote">so eval, when needed, could get clobb= ered with whatever realm you want the evalling to happen in, instead of req= uiring all realms, even realms that aren't planning on evalling anythin= g, to have one.</div></div></div></blockquote><div><br></div><div>I'm s= orry, I don't understand the suggestion. What does evalFactory do?</div= ><div><br></div><div><br></div><div>=C2=A0</div><blockquote class=3D"gmail_= quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1= ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><span class=3D""><div class= =3D"gmail_quote"><br></div><div class=3D"gmail_quote"><br></div><div class= =3D"gmail_quote"><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8= ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div class= =3D"gmail_quote"><div dir=3D"ltr"><div><br></div><div>It is now ready for c= omments at=C2=A0<a href=3D"https://github.com/FUDCo/ses-realm" target=3D"_b= lank">https://github.com/FUDCo/ses-realm</a></div></div></div></div></block= quote><div><br></div><div><br></div><div>=C2=A0</div></div><div><br></div><= /span><span class=3D"HOEnZb"><font color=3D"#888888">-- <br><div><div dir= =3D"ltr"><div><div dir=3D"ltr"><span style=3D"color:rgb(51,51,51);font-fami= ly:Georgia,Times,'Times New Roman',serif;font-size:15px;line-height= :21px">A circular pizza with radius Z and thickness A has a volume of PI (Z= *Z) A</span><br></div></div></div></div> </font></span></div></div> <br>_______________________________________________<br> cap-talk mailing list<br> <a href=3D"mailto:[email protected]">[email protected]</a><= br> <a href=3D"http://www.eros-os.org/mailman/listinfo/cap-talk" rel=3D"norefer= rer" target=3D"_blank">http://www.eros-os.org/mailman/listinfo/cap-talk</a>= <br> <br></blockquote></div><br><br clear=3D"all"><div><br></div>-- <br><div cla= ss=3D"gmail_signature">=C2=A0 =C2=A0 Cheers,<br>=C2=A0 =C2=A0 --MarkM</div>= <div class=3D"gmail_signature"><br></div> </div></div> --001a11442ef87b80d3052e5ead7d-- --===============3775904308064700481== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ cap-talk mailing list [email protected] http://www.eros-os.org/mailman/listinfo/cap-talk --===============3775904308064700481==--