Mike Samuel mikesamuel
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <script>/**/alert('svg');//*/alert('html'); | |
| //<![CDATA[</script><!--]]>--></script> | |
| <svg> | |
| <script>/**/alert('svg');//*/alert('html'); | |
| //<![CDATA[</script><!--]]>--></script> | |
| </svg> |
mikesamuel
/ type-checking-code-loaders.js
Last active
January 20, 2019 15:16
Checking arguments to Function/eval
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| class TrustedScript { // Just a stub of github.com/wicg/trusted-types | |
| constructor(x) { | |
| this.content = String(x); | |
| } | |
| toString() { | |
| return this.content; | |
| } | |
| static createUnsafely(x) { |
mikesamuel
/ monkey-with-JSON.js
Last active
August 6, 2018 16:00
Monkeypatching JSON to distinguish parsed objects from user-code created objects
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /** | |
| * A symbol that should only be added to objects whose | |
| * properties come from an external string, or which include | |
| * uncherry-picked properties from such an object. | |
| */ | |
| const PARSER_OUTPUT_SYMBOL = Symbol('parserOutput'); | |
| function markingReviver(_, value) { | |
| "use strict"; | |
| if (value && typeof value === 'object') { | |
| // HACK: This might fail if optReviver freezes values. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js | |
| index 33d8907e4f..6df7c32efd 100644 | |
| --- a/lib/internal/modules/cjs/loader.js | |
| +++ b/lib/internal/modules/cjs/loader.js | |
| @@ -46,6 +46,9 @@ const preserveSymlinks = !!process.binding('config').preserveSymlinks; | |
| const preserveSymlinksMain = !!process.binding('config').preserveSymlinksMain; | |
| const experimentalModules = !!process.binding('config').experimentalModules; | |
| +const { defineProperties, hasOwnProperty } = Object; | |
| +const { apply } = Reflect; |
mikesamuel
/ corner-cases.md
Last active
June 21, 2018 19:30
GH Markdown auto-identifier corner cases
mikesamuel
/ no-proto-json-parse.js
Created
June 5, 2018 06:46
JSON.parse that filters out __proto__
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| JSON.parse = (() => { | |
| const undef = void 0; | |
| const jsonParse = JSON.parse; | |
| function noProtoReviver (key, value) { | |
| if (key === '__proto__') { | |
| console.warn('Removed __proto__ from parsed JSON'); | |
| return undef; // Remove property entirely | |
| } | |
| return value; | |
| } |
mikesamuel
/ hashable-json.js
Last active
February 21, 2019 05:43
A canonicalizing function to make it easy to hash JSON
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| "use strict"; | |
| // Prompted by https://esdiscuss.org/topic/json-canonicalize | |
| // Given a string of JSON produces a string of JSON without unnecessary | |
| // degrees of freedom like whitespace, optional escape sequences, and | |
| // unnecessary variance in number representation. | |
| function hashable(json) { | |
| const strs = [] // Side table to collect string bodies | |
| return reorderProperties( |
mikesamuel
/ frenemies.md
Last active
February 28, 2018 16:29
Frenemies: Mutual suspicion in Node.js
Lets project teams trust code they know with more than code they don't.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <html> | |
| <title>sanitize-html testbed</title> | |
| <script> | |
| // Inlined the result of | |
| // $ npm install sanitize-html | |
| // $ browserify --bare node_modules/sanitize-html/index.js | |
| // and added window.sanitizeHtml = sanitizeHtml; | |
| (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){ | |
| var htmlparser = require('htmlparser2'); |