New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Avoid hitting __proto__ in _inheritsLoose #12693
Conversation
Build successful! You can test your changes in the REPL here: https://babeljs.io/repl/build/38453/ |
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. Latest deployment of this branch, based on commit f792449:
|
6a37c91
to
f792449
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks!
This avoids hitting
__proto__
for hardened environments where__proto__
is disabled.See discussion in nodejs/node#31951 and these changes: nodejs/node#32279, denoland/deno#4341.
Note that per spec,
__proto__
is defined in section B.2.2 (Additional ECMAScript Features for Web Browsers → B.2.2 Additional Properties of the Object.prototype Object), which is optional for non-browsers:Class transforms should not rely on
__proto__
to be present, as classes are defined in section 14.6.To check that this works, run with:
NODE_OPTIONS=--disable-proto=throw
before and after this change (or any generatedoutput.js
files in loose mode):I believe this could be a semver-patch or a semver-minor for v7.
Note: before v7, this was not the only place which hit
__proto__
, but #7675 resolved the other one in v7.