fix(ses): Limit scope proxy exposure to discernably owned properties … #2743
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Integration with Agoric SDK Agoric/agoric-sdk#11133 |
mhofman
approved these changes
Mar 19, 2025
kriskowal
force-pushed
the
kriskowal-1305
branch
from
91e70b3 to
ea83cfc
Compare
…of host globalThis Closes #1305
kriskowal
force-pushed
the
kriskowal-1305
branch
from
ea83cfc to
9ced73a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…of host globalThis
Closes #1305
Description
This change circles back to an old observation about the scope proxy, where we deliberately allow guest code to sense which properties of the host globalThis exist in order to provide a higher fidelity behavior for
typeofstyle feature detection. This change reflects a shift in our preference to avoid this information leak at the expense of ecosystem compatibility. We have come to believe closing the leak is worth the expense, especially given that the work-around of checkingglobalThisproperties explicitly has become a norm.Security Considerations
This change increases confinement in exchange for a minor loss of ecosystem compatibility.
Scaling Considerations
None.
Documentation Considerations
Forthcoming.
Testing Considerations
This change will be validated with an integration PR with Agoric SDK to expose any extant compatibility risks.
Compatibility Considerations
This change may uncover existing code that relied on
typeoffor feature detection, which is not strictly compatible. We are treating these considerations as bug fixes.Upgrade Considerations
These changes will become observable to vats upon restart after this software arrives in an Agoric chain software update.