Skip to content

feat(ses): tolerate omitted species#2108

Merged
erights merged 3 commits into
masterfrom
markm-tolerate-omitted-species
Feb 28, 2024
Merged

feat(ses): tolerate omitted species#2108
erights merged 3 commits into
masterfrom
markm-tolerate-omitted-species

Conversation

@erights

@erights erights commented Feb 28, 2024

Copy link
Copy Markdown
Contributor

closes: #XXXX
refs: #XXXX

Description

MetaMask is targeting React Native, that run on the Hermes JS engine. Thus, it would be good for the ses-shim to work on Hermes. Once problem we ran into is that Hermes omits Symbol.species. (Good riddance!) With this PR, the ses-shim should tolerate this difference from standard JS.

Security Considerations

Assuming that the semantics of the JS they implement is adjusted from the standard semantics in any of the obvious ways to cope with the absence of Symbol.species, this should have little effect on security.

Those "obvious ways" are

  • Just act as if the species is always the base constructor itself. IOW, when asking a subclass of Array to .map, return an array rather than an instance of this or a related subclass of array.
  • Just use constructor for what Symbol.species would have been used for. IOW, when asking a subclass of Array to .map, return an instance of this subclass rather than a somehow related subclass of array.

(FWIW, I further assume they make the first choice. Otherwise, what's the point of the omission? However, this PR should be compat with either.)

I say "little effect on security" above because this absence can in theory mislead correct JS code into silently doing the wrong thing.

Scaling Considerations

None

Documentation Considerations

None

Testing Considerations

I leave that to those set up to test on Hermes, since that is the point. Attn @naugtur @kumavis

Compatibility Considerations

It only causes an observable difference on platforms that omit Symbol.species, on which the ses shim previously refused to run. So none.

Upgrade Considerations

None. Nothing Breaking certainly. Nothing newsworthy yet. But when the ses-shim as a whole is know to support Hermes, that will be newsworthy ;)

  • Includes *BREAKING*: in the commit message with migration instructions for any breaking change.
  • Updates NEWS.md for user-facing changes.

@erights erights self-assigned this Feb 28, 2024
@erights erights marked this pull request as ready for review February 28, 2024 19:55
@erights erights force-pushed the markm-tolerate-omitted-species branch from cd9a1d9 to e6d9322 Compare February 28, 2024 20:06
@erights erights requested a review from gibson042 February 28, 2024 20:07
Comment thread packages/ses/src/tame-regexp-constructor.js Outdated
Comment thread packages/ses/src/tame-regexp-constructor.js Outdated
@erights erights merged commit 70c85ef into master Feb 28, 2024
@erights erights deleted the markm-tolerate-omitted-species branch February 28, 2024 21:32
mhofman pushed a commit that referenced this pull request May 7, 2024
…j literal short-hand methods (#2206)

Fix SES compat with Hermes when calling
`addIntrinsics(tameSymbolConstructor());`
- #1891

Follow-up to
- #2108
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants