Wednesday, November 11, 2015

see what i mean? (and i especially mean everything, right through the comment, too.)

Here’s another especially fragile bit of Closure Library. From base.js, line 677:
goog.isDef = function(val) {
 return val !== undefined;
};
 
This function checks if a particular variable has a value defined. Or it does, unless a 3rd party script sets the global undefined variable to something else. This single line of code anywhere in the page will bring Closure Library crashing down:
var undefined = 5;
  
Relying on the global undefined variable is another rookie mistake for JavaScript library authors.

You might think that anyone who assigns a value to undefined deserves what they get, but the fix in this case is trivial: simply declare a local undefined variable for use within the function!
goog.isDef = function(val) {
  var undefined;
  return val !== undefined;
};

No comments:

Post a Comment