Re: [Caja] Functional auditor for Cajita

2009/12/8 David-Sarah Hopwood <[email protected]>:
> Mike Samuel wrote:
>> Is the following copacetic by that definition?
>>
>>   (function (eval, s) {
>>     eval(s);
>>   })
>
> Trivially no, since it isn't annotated as functional nor pure.
> Also, Cajita is a subset of ES5-strict, which prohibits 'eval' from
> being used as a formal parameter name:
>
> # It is a SyntaxError if the identifier eval or arguments appears
> # within a FormalParameterList of a strict mode FunctionDeclaration
> # or FunctionExpression (13.1)
>
> Let's fix these problems first:
>
>  var f = /*@functional*/ function (evil, s) {
>    evil(s);
>  };
>
> f is now copacetic.
>
>> If passed the arguments (freeze(eval), 'a = 0') it will modify the
>> lexical environment, and I think both arguments are copacetic
>> according to the frozen functions definition,
>
> In
>
>  f(cajita.freeze(eval), 'a = 0;');
>
> there is a free variable reference 'eval', and the global eval is
> not accessible to Cajita code. So this program is not valid Cajita.

So it is not a goal for a copacetic program to maintain its properties
when functions defined in it are called by non-strict non-cajita code.
So it is the copacetic program parsers responsibility to make sure
that such functions do not escape to where they could be called that
way?


> Suppose that a hypothetical Cajita were extended with a restricted
> cajita.eval function. (It would be frozen so we don't need to explicitly
> freeze it.) Then cajita.eval could not be marked as copacetic. Still,
>
>  f(cajita.eval, 'a = 0;');
>
> would succeed up to the point where it calls cajita.eval('a = 0;')
> (because f is only marked as functional, not pure, so its
> cajita.eval argument is not required to be copacetic). But then it
> would fail because 'a = 0;' is not a valid Cajita program (it tries to
> assign to a free variable).
>
> Even if it did not fail for that reason, cajita.eval would presumably
> be modelled on ES5-strict "global eval", which cannot directly modify
> its lexical environment.
>
> OTOH,
>
>  f(cajita.eval, 'var a = 0;');
>
> would succeed, but is harmless.
>
> Note that single-argument cajita.eval would have to treat its code as
> being in an empty lexical environment (apart from safe globals).
> There could potentially be a variant that would support evaluation
> in an explicitly specified environment:
>
>  var f2 = /*@functional*/ function (evil, s, e) {
>    evil(s, e);
>  };
>
>  var env = {a: undefined};
>  f(cajita.eval, 'a = 0;', env);
>
> but since env is not frozen (and neither cajita.eval nor f are pure),
> there is no reason to expect this code to be prevented from mutating
> env.a.
>
> --
> David-Sarah Hopwood  ⚥  http://davidsarah.livejournal.com
>
>
_______________________________________________
e-lang mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/e-lang