Move EventTarget's getTheParent to a private property so it can't be accessed directly?

[benjamingr]

A user has pointed out to me in an issue report in Node.js that it's possible to override getTheParent on JSDom's EventTarget's but not Node's by overriding _getTheParent.

A real EventTarget does not allow users to override getTheParent.

Is there anything JSDom can do in order to guard against this so that overriding classes (like Node) can override "get the parent" but userland cannot (like the spec)?

[benjamingr]

(This issue is not high priority - I just opened it because I noticed a possible divergence from the spec)

[domenic]

This shouldn't be possible; the -impl (e.g. EventTargetImpl) classes are hidden and not exposed. Can you post a reproduction case following the issue template?

[benjamingr]

Yes, apologies, I will ask the person who reported this to do this.

[benjamingr]

OK, they have provided me with a reproducing case though I think the current behaviour is reasonable and it should be obvious to anyone writing such code that this sort of usage isn't supported or recommended.

I would honestly probably just close this issue if I was a maintainer, JSDom's current behaviour sounds pretty reasonable.

That said, if you want complete spec compliance, technically this should likely be guarded with something more private than a symbol.

I have followed the issue template:

---

Basic info:

• Node.js version: master (but also works on 14.4.0)
• jsdom version: + jsdom@16.4.0

Minimal reproduction case

const { JSDOM } = require("jsdom");
const eventTarget = new (new JSDOM()).window.EventTarget();
const impl = Object.getOwnPropertySymbols(eventTarget).find(s => s.description === 'impl');
const otherEventTarget = new (new JSDOM()).window.EventTarget();
e[impl]._getTheParent = () => otherEventTarget;

How does similar code behave in browsers?

This is impossible to do in browsers as getTheParent is not accessible.

[domenic]

Haha, OK, yeah, that is definitely not public API. We considered moving to WeakMap in jsdom/webidl2js#155 to prevent such abuses, but it was a bit too costly in performance.