feat: add stable --unsafe-proto flag#34738
Open
bartlomieju wants to merge 6 commits into
Open
Conversation
Deno disables the Object.prototype.__proto__ accessor by default for security reasons. Previously this was done by deleting the property, which made __proto__ reads silently return undefined and writes silently create a useless own property. These silent failures are hard to debug. Instead, replace the accessor with one that throws a descriptive TypeError (similar to Node's --disable-proto=throw). The security property is preserved and the __proto__ object-literal syntax keeps working. --unstable-unsafe-proto still restores the native accessor.
Object.hasOwn no longer distinguishes the disabled state now that the accessor is replaced (and throws) rather than deleted.
Adds --unsafe-proto as a stable alias for --unstable-unsafe-proto, mirroring how --sloppy-imports aliases --unstable-sloppy-imports. It enables the same behavior (restoring the native Object.prototype.__proto__ accessor) without being spelled as an unstable flag.
bartlomieju
changed the title
# Conflicts: # runtime/js/99_main.js
Contributor
|
Lines 734 to 737 in 7aceb22 I think it's one of their best decisions that Deno disables accessor to |
Member
Author
And I don't agree. The amount of stupid bugs this causes in many popular npm packages just doesn't justify disabling it. |
Member
Author
|
Opened #35192 that will complement this PR and should make it more obvious for consumers of packages that need |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
--unsafe-protoflag as a stable shorthand for--unstable-unsafe-proto. Both restore the nativeObject.prototype.__proto__accessor (which Deno otherwise disables),but
--unsafe-protois spelled as an ordinary flag rather than anunstable one.