[jwrosewell]

Problem

The JavaScript Builder lets a site name the global object the client script creates. The script declares it with a top level var, so a name that is a read-only property of the browser's Window object never creates the object, and eval replaces the page's own function. location navigates the page away. The specification's JavaScript builder page lists the names to refuse, and this repository refused only the language's reserved words, Infinity, NaN, undefined and the builder's own constructor name.

For specifications#114, which merged on 9 November. It extends the Object name section of javascript-builder.md, pinned at 8aa2de01 on specifications rc, first merged in specifications#113.

What changed

JavaScriptBuilderElement.RESERVED_OBJECT_NAMES now also refuses these 30 names, with the existing behaviour for a refused name kept as it was. A configured name is a PipelineConfigurationException, from the builder and from the constructor, and a name in the request's evidence falls back to the configured name with a warning.

• eval, arguments
• window, document, top, name, status, history, navigator, closed, location
• frameElement, isSecureContext, crossOriginIsolated, trustedTypes, crypto, indexedDB, localStorage, sessionStorage, caches, cookieStore, speechSynthesis, styleMedia
• crashReport, credentialless, customElements, documentPictureInPicture, fence, launchQueue, originAgentCluster

These are exactly the names the Object name section lists beyond the reserved words, Infinity, NaN, undefined and fiftyoneDegreesManager. caches, cookieStore and documentPictureInPicture are refused, as the section says, although they exist only in a secure context, so that whether a name is valid does not depend on the page's scheme. let was already refused because it is reserved in strict mode (ECMA-262 section 13.1.1). self, frames, parent, opener and length stay allowed because a top level var can replace them, and so do near misses such as windows, Window and cachesX.

The comment above the list gives each group's reason as the section does. Strict mode code cannot declare eval and arguments, and eval would also replace the page's own function. A top level var cannot replace the Window properties, so the object would never be created, and location navigates the page away.

The session id check in the builder (^[A-Za-z0-9-]{1,64}$, an empty session id otherwise) was already in place and tested, so it is not changed here.

The same list in the other languages

The set and the order are the same as the four merged changes, so every language refuses exactly the same names.

Language	Change
Python	#73
PHP	#53
Go	#69
Rust	#362
.NET	#123, open beside this one

Tests

The tests were written first, in JavaScriptObjectNameTests.java. Each refused name is checked from the builder, from the constructor, from the request's evidence and through isValidObjectName, and each allowed name is checked as accepted.

• Red, on rc with only the tests added: run 42699059220, failure.
• Green, with the change: run 42702288800, success.

Both ran on 9 November, so they are the red and green of the change itself and not of this head. The head has moved only by the merge of rc described below, and the full build covers it.

Full build

Commit 6058d00 merges the current rc at ddb7d04, with no conflict. Nothing else has changed since the green run.

Run 43020308064, success, on head 6058d003ce714e48f66b34aca88c78dc1ec54ccf. Configure, the nine build and test jobs (Ubuntu x64 with Java 8, 11, 17 and 21, Ubuntu ARM with Java 17, and Windows with Java 8, 11, 17 and 21) and Complete all passed on the first attempt. All 10 Setting 'PullRequestSha' lines are 6058d003ce714e48f66b34aca88c78dc1ec54ccf, the head, and the Configure log reads "Left out 6 macOS entries".

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

Still to do

• Review by someone other than the author.