angular/angular.js — pull request #4865 by maxwellium (2013-11-10 14:29:51+00:00)
Title: Revert "feat($parse): secure expressions by hiding "private" properties"

Reverting change introduced by chirayuk which needs further discussion.
Check line 29 (26 after commit): "The goal is to prevent exploits against the expression language, but not to prevent exploits that were enabled by exposing sensitive JavaScript or browser apis on Scope."

But chirayuk's commit enforces a convention to regard all properties beginning or ending with underscore as private. Breaks every nonSQL db implementation i know, forcing overhead code.

While white-/blacklisting accessible properties for expressions is a nice feat, this is imho the wrong approach and does not add much in terms of security.
An attacker at this level is able to read everything on scope. The advocated change and the respective tests convey a false sense of security to unaware devs and will lead to complacency.

This reverts commit 3d6a89e8888b14ae5cb5640464e12b7811853c7e.