[jwrosewell]

Problem

The JavaScript builder writes the client side object's name into the script as
a top level var, as a session storage key and inside string literals. The
list of names it refused, reservedObjectNames in
javascriptbuilder.js,
held only the reserved words of the language, the three global values
Infinity, NaN and undefined, and the constructor the script defines. A
name such as window, location, localStorage or eval was therefore
accepted, and in a browser a top level var cannot replace those properties of
the Window object, so the object would never be created. var location is
worse, because the Window object declares location with [PutForwards=href],
so the assignment sets location.href to the object's text,
[object Object], and navigates the page away.

Python, PHP, Go and Rust already refuse them, so a name a site may set in one
language was refused there and accepted here.

What the specification says

javascript-builder.md, Object name,
at the fixed commit 8aa2de01 on rc, says a valid object name matches
^[A-Za-z_$][A-Za-z0-9_$]*$ and is none of the following.

• a JavaScript reserved word, including those reserved in strict mode and
  null, true and false;
• eval or arguments, which strict mode code cannot declare ... and
  because the script declares the object with a top level var that is not
  strict mode code, eval would replace the page's own eval function;
• Infinity, NaN or undefined, or, in a browser, any of the following
  properties of the Window object, none of which a top level var can
  replace in a secure context, so the object would never be created:
  window, document, top, name, status, history, navigator,
  closed, frameElement, customElements and originAgentCluster ...
  isSecureContext, crossOriginIsolated, localStorage and
  sessionStorage ... crypto, indexedDB, caches, trustedTypes,
  cookieStore and speechSynthesis ... crashReport, credentialless,
  documentPictureInPicture, fence and launchQueue ... styleMedia,
  which Chrome defines although no standard does.
• location, which the Window object declares with [PutForwards=href] ...
• fiftyoneDegreesManager, which is the constructor the script defines.

It also says caches, cookieStore and documentPictureInPicture exist only
in a secure context and are refused on every page, so that whether a name is
valid does not depend on the page's scheme. And that a configured name which
is not valid MUST be refused when the element is built, using the language's
usual configuration error.

Change

javascriptbuilder.js

• reservedObjectNames gains eval, arguments and the 28 Window property
  names the page lists, which are the same 28 names and in the same order as
  51degrees-python#73
  added to RESERVED_WORDS.
• The comment above the list now names arguments, and says that location
  is refused because a top level var navigates the page away rather than
  because it cannot be replaced, which is the reason Python, Go and Rust give.

isValidObjectName already decided both routes, so both are closed by the one
list. A name that arrives as the query.fod-js-object-name evidence is ignored
with a warning and the configured name is used, and a name set in the builder's
options is refused when the element is built with objName is invalid.

Nothing else changes. One comment in
callbackUrl.test.js
is wrapped to 80 columns, which the 19021bc commit did and which is left in
rather than moving the head again for a comment.

The same change in the other languages

Language	Pull request	List
Python	#73	eval, arguments and the 28 names, same order
PHP	#53	the same names
Go	#69	the same names, as a map
Rust	#362	the same names, as a sorted array

.NET #123 and Java
#88 carry the same
change and are not mine.

Tests

objectName.test.js
adds three parameterised tests over two lists, which are the same two lists
Python #73 uses.

• refusedNames holds the 30 names the specification refuses that are not
  reserved words of the language. For each, a name in the evidence is ignored
  with one warning and the script still builds a working fod object, and a
  name in the builder's options throws objName is invalid.
• allowedNames holds self, frames, parent, opener, length,
  windows, Window and cachesX, which are Window properties a top level
  var can replace and near misses of refused names. Each is used as given,
  with no warning, and the script parses and runs.

Red. Run 43019585447,
on tmp/node-60-red, which is rc at 8b9fc3d with this test file and nothing
else from the branch. 60 of the 86 tests failed, being the two tests for each
of the 30 refused names, and the 26 that passed are the 8 allowed names and the
tests the file already had.

Green. Run 43019785636,
on tmp/node-60-green, which is this head. 86 of 86 passed.

Full build. Run 43019649181, on tmp/pr-matrix-60, success. Every one of its seven Setting 'PullRequestSha' lines reads b0bd8f6df50b04a259534caddca5aea33016cd31, which is this head. Configure printed "Left out 2 macOS entries".

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

What remains

Nothing in Node. The same change in .NET and Java is in
51degrees-dotnet#123
and 51degrees-java#88.