5 ms·
I'm not sure I'm a fan of the 'Enhance' concept[0]. It seems to be similar to prototype Pollution in JavaScript[1] which is generally considered bad practice.
by codefined 5y ago
I'm not sure I'm a fan of the 'Enhance' concept[0]. It seems to be similar to prototype Pollution in JavaScript[1] which is generally considered bad practice. I can't tell, is `Enhance` scoped to the current context? Or does it affect all of that type throughout the rest of the program?
[0] https://lang-senegal.web.app/docs/enhance https://lang-senegal.web.app/docs/enhance
[1] https://portswigger.net/daily-swig/prototype-pollution-the-dangerous-and-underrated-vulnerability-impacting-javascript-applications https://portswigger.net/daily-swig/prototype-pollution-the-d...
- Zababa 5y agoThe "enhance" seem to be monkey patching, which is a common practice in dynamic languages. Prototype pollution is when malicious people use monkey patching to introduce vulnerabilities.
- codefined 5y agoThere are non-malicious issues related to prototype pollution. The most recent that comes to mind are packages overwriting each other. How do you handle two enhances that add the same function name? In JavaScript the second overwrites the first, which can cause issues if the functions do different things.
- crabmusket 5y agoThis may be apocryphal, but I thought JS's `Array.includes` method was so-named when it was added to the spec to avoid conflicting with popular libraries that were adding a `contains` method to the Array prototype. In order to avoid conflicting and breaking existing sites, a less-common name was chosen for the spec.
- Zababa 5y agoThat was the case with Array.prototype.flat, that was supposed to be Array.prototype.flatten but flatten was already used by MooTools, and they respected the "don't break the web".