SES Meeting: Secure Mode
Channel: Agoric
Date: 02/06/2023

Santiago Díaz discusses Google’s proposal for mitigating data-only prototype-pollution-attacks.
 
In this meeting, Mark asked Santiago to use responsible disclosure for a possible case where Object.freeze does not maintain its invariants. Out-of-band, that investigation revealed a coding pattern that works as designed and does not violate any invariants: it is possible to overshadow a non-writable property up the prototype chain using definition semantics, but not assignment semantics. The frozen prototype does not change.