{"action":"created","issue":{"url":"https://api.github.com/repos/josdejong/mathjs/issues/888","repository_url":"https://api.github.com/repos/josdejong/mathjs","labels_url":"https://api.github.com/repos/josdejong/mathjs/issues/888/labels{/name}","comments_url":"https://api.github.com/repos/josdejong/mathjs/issues/888/comments","events_url":"https://api.github.com/repos/josdejong/mathjs/issues/888/events","html_url":"https://github.com/josdejong/mathjs/pull/888","id":239510906,"number":888,"title":"Prototyped Scopes","user":{"login":"ThomasBrierley","id":12444321,"avatar_url":"https://avatars3.githubusercontent.com/u/12444321?v=3","gravatar_id":"","url":"https://api.github.com/users/ThomasBrierley","html_url":"https://github.com/ThomasBrierley","followers_url":"https://api.github.com/users/ThomasBrierley/followers","following_url":"https://api.github.com/users/ThomasBrierley/following{/other_user}","gists_url":"https://api.github.com/users/ThomasBrierley/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasBrierley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasBrierley/subscriptions","organizations_url":"https://api.github.com/users/ThomasBrierley/orgs","repos_url":"https://api.github.com/users/ThomasBrierley/repos","events_url":"https://api.github.com/users/ThomasBrierley/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasBrierley/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":15,"created_at":"2017-06-29T15:04:50Z","updated_at":"2017-07-10T14:56:29Z","closed_at":"2017-07-05T20:01:30Z","pull_request":{"url":"https://api.github.com/repos/josdejong/mathjs/pulls/888","html_url":"https://github.com/josdejong/mathjs/pull/888","diff_url":"https://github.com/josdejong/mathjs/pull/888.diff","patch_url":"https://github.com/josdejong/mathjs/pull/888.patch"},"body":"Restore access to inherited properties and methods removed by the recent security fixes.\r\n\r\nFixes #886\r\n\r\n**I am not a security expert so please do review these changes carefully.**\r\n\r\nThe most significant changes are in c4951c2, commit message:\r\n\r\n```\r\nTo safely restore inherited properties and methods on plain objects e.g\r\nwith Object.create, some overly broad conditions need to be removed and\r\nothers added to more explicitly exclude unsafe properties.\r\n\r\nisSafeMethod() has been modified as bellow, roughly the same conditions\r\nare also now used in isSafeProperty() for get/setSafeProperty() which\r\npreviously restricted all inherited properties.\r\n\r\n- Require __proto__ to have own-method\r\n\tIntended to prevent ghosting of class methods, but also prevents\r\n\taccess to properties from further up the chain.\r\n\r\n+ Require any own-method to not be in __proto__\r\n\tExplicitly prevents ghosting but not inheritance. Possible to\r\n\tdefeat only if proto chaining through Object.create is allowed.\r\n\r\n- Require object to not be function\r\n\tIntended to prevent unsafe function methods like 'bind', but\r\n\talso restricts function own-properties.\r\n\r\n+ Require method not be in Function.prototype\r\n\tExplicitly prevents unsafe function methods like 'bind',\r\n\twithout restricting function own properties.\r\n\r\nOther conditions should be equivalent. The overall affect should be\r\nthat inherited properties and methods that are safe and not ghosted\r\nshould be allowed.\r\n```"},"comment":{"url":"https://api.github.com/repos/josdejong/mathjs/issues/comments/314131749","html_url":"https://github.com/josdejong/mathjs/pull/888#issuecomment-314131749","issue_url":"https://api.github.com/repos/josdejong/mathjs/issues/888","id":314131749,"user":{"login":"ThomasBrierley","id":12444321,"avatar_url":"https://avatars3.githubusercontent.com/u/12444321?v=3","gravatar_id":"","url":"https://api.github.com/users/ThomasBrierley","html_url":"https://github.com/ThomasBrierley","followers_url":"https://api.github.com/users/ThomasBrierley/followers","following_url":"https://api.github.com/users/ThomasBrierley/following{/other_user}","gists_url":"https://api.github.com/users/ThomasBrierley/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasBrierley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasBrierley/subscriptions","organizations_url":"https://api.github.com/users/ThomasBrierley/orgs","repos_url":"https://api.github.com/users/ThomasBrierley/repos","events_url":"https://api.github.com/users/ThomasBrierley/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasBrierley/received_events","type":"User","site_admin":false},"created_at":"2017-07-10T14:56:29Z","updated_at":"2017-07-10T14:56:29Z","body":"Sorry I think I may not have adequately explained what ghosting is supposed to be... The effect you are describing is an intentional result of the ghosting condition (the intent being to disallow overriding _any_ inherited property.)\r\n\r\nThis is probably more of a security concern for methods (or at least app logic defeating concern). Overridden methods on instances might cause strange or possibly insecure behaviour when called internally.\r\n\r\nI thought it was a good idea to apply to properties because ghosting in this sense is also something discouraged for the sake of clarity, however your config example shows reasonable and practical uses.\r\n\r\nWhat if ghosting was still disallowed for methods but not other properties?\r\n\r\nI'm not sure whether or not overriding properties is a security concern."}}
{"actor":{"display_login":"ThomasBrierley"}}