Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Anticipate new hidden intrinsics: Iteration helpers #1289

Closed
erights opened this issue Sep 17, 2022 · 3 comments · Fixed by #1655 or #1670
Closed

Anticipate new hidden intrinsics: Iteration helpers #1289

erights opened this issue Sep 17, 2022 · 3 comments · Fixed by #1655 or #1670
Assignees
Labels
integrity Corrupted execution continues ses

Comments

@erights
Copy link
Contributor

erights commented Sep 17, 2022

As proposals advance in tc39, some will introduce new hidden intrinsics, starting with Iteration helpers. At the Sep 2022 tc39 meeting, we agreed on a compromise where the proposal provides code for discovering these new hidden intrinsics. The ses-shim would use this code in order to add these hidden intrinsics to the collection of intrinsics to be checked against the whitelist and hardened. This compromise is only needed until the getIntrinsics proposal lands, which will provide a unified mechanism for discover all intrinsics.

https://github.com/tc39/proposal-iterator-helpers/pull/235/files is an adequate approximation of this agreement. We need to modify it so it doesn't fail if run on a system in which these are not present. With that modification, we should adopt it into the ses-shim well ahead of anyone shipping an engine that implements the Iterator helpers proposal.

(During the Google era of SES, we had a bad vulnerability do to failure to add code to discover the async generator intrinsics until after it was shipping. Fortunately, it was responsibly disclosed and we have no reason to believe it was ever maliciously exploited.)

Attn @michaelficarra @ljharb @kriskowal

@mhofman
Copy link
Contributor

mhofman commented Sep 26, 2022

Even if we don't ship this ahead of engine implementations, it shouldn't be an issue since these hidden intrinsics are only available through new APIs not part of the whitelist, right?

@erights
Copy link
Contributor Author

erights commented Dec 24, 2022

@kriskowal @mhofman what was the other thing we committed to fixing in anticipation?

@erights
Copy link
Contributor Author

erights commented Jul 6, 2023

#1670 points out flaws in #1655 , so reopening in anticipation of being properly closed by #1670

@erights erights reopened this Jul 6, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
integrity Corrupted execution continues ses
Projects
None yet
3 participants