Skip to content

Prototype pollution #816

@ZLJasonG

Description

@ZLJasonG

After importing a transcrypt module, various prototypes such as Array, String, Uint8Array are polluted with python specific helper functions. These appear to be coming from the org.transcrypt.runtime.js module such as

Array.prototype.extend = function (aList) { this.push.apply (this, aList); }; 

Unfortunately these functions are listed as enumerable resulting in unexpected behaviour in external code ran later when its iterating even when the array wasn't created in the python code. Executing the following in the js console after simply importing the module

for( v in []){ console.log(v) } 

results in all these items being output

_class__ __iter__ __getslice__ __setslice__ __repr__ __str__ append py_clear extend insert remove index py_pop py_sort __add__ __mul__ __rmul__ __bindexOf__ add discard isdisjoint issuperset issubset union intersection difference symmetric_difference py_update __eq__ __ne__ __le__ __ge__ __lt__ __gt__ 

Changing it to be defined as the following appears to resolve the issue and doesn't appear to impact the functionality in my test case

Object.defineProperty(Array.prototype, 'extend', {	value: function (aList) {	this.push.apply (this, aList);	},	enumerable: false,	writable: true }) 

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions