[Extensions] Sprinkle in some more null protos and defineProperty's

extensions/renderer/resources/binding.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var Event = require('event_bindings').Event;
 var forEach = require('utils').forEach;
 // Note: Beware sneaky getters/setters when using GetAvailbility(). Use safe/raw
 // variables as arguments.
 var GetAvailability = requireNative('v8_context').GetAvailability;
 var exceptionHandler = require('uncaught_exception_handler');
 var lastError = require('lastError');
 var logActivity = requireNative('activityLogger');
 var logging = requireNative('logging');
 var process = requireNative('process');
 var schemaRegistry = requireNative('schema_registry');
 var schemaUtils = require('schemaUtils');
 var utils = require('utils');
 var sendRequestHandler = require('sendRequest');
 
 var contextType = process.GetContextType();
 var extensionId = process.GetExtensionId();
 var manifestVersion = process.GetManifestVersion();
 var sendRequest = sendRequestHandler.sendRequest;
 
 // Stores the name and definition of each API function, with methods to
 // modify their behaviour (such as a custom way to handle requests to the
 // API, a custom callback, etc).
 function APIFunctions(namespace) {
-  this.apiFunctions_ = {};
-  this.unavailableApiFunctions_ = {};
+  this.apiFunctions_ = { __proto__: null };
+  this.unavailableApiFunctions_ = { __proto: null };

[robwu, 2016/04/21 10:29:33]

Typo: __proto -> __proto__.

[Devlin, 2016/04/21 18:28:30]

D'oh, done.

   this.namespace = namespace;
 }
 
+APIFunctions.prototype = {
+  __proto__: null,
+};
+
 APIFunctions.prototype.register = function(apiName, apiFunction) {
   this.apiFunctions_[apiName] = apiFunction;
 };
 
 // Registers a function as existing but not available, meaning that calls to
 // the set* methods that reference this function should be ignored rather
 // than throwing Errors.
 APIFunctions.prototype.registerUnavailable = function(apiName) {
   this.unavailableApiFunctions_[apiName] = apiName;
 };
@@ skipping 133 matching lines @@
 }
 
 var platform = getPlatform();
 
 function Binding(apiName) {
   this.apiName_ = apiName;
   this.apiFunctions_ = new APIFunctions(apiName);
   this.customHooks_ = [];
 };
 
-Binding.create = function(apiName) {
-  return new Binding(apiName);
-};
+$Object.defineProperty(Binding, 'create', {

[robwu, 2016/04/21 10:29:33]

Also use __proto__: null in the property descriptor if you want to make sure
that this call doesn't throw. E.g. if a script does the following before
activating extension bindings, then defineProperty would throw:

Object.prototype.get = 'anything';

[Devlin, 2016/04/21 18:28:30]

I'm not as worried about avoiding throwing at the moment (it's actually pretty
trivial to make bindings throw - if anything is already defined on the object
prototype, we throw at line 377, so doing
Object.defineProperty(Object.prototype, 'connect', ...) would do it).

But, one line change - worth it.  Done.

+  configurable: false,
+  enumerable: false,
+  value: function(apiName) { return new Binding(apiName); },
+  writable: false,
+});
 
 Binding.prototype = {
   // Sneaky workaround for Object.prototype getters/setters - our prototype
   // isn't Object.prototype. SafeBuiltins (e.g. $Object.hasOwnProperty())
   // should still work.
   __proto__: null,
 
   // Forward-declare properties.
   apiName_: undefined,
   apiFunctions_: undefined,
@@ skipping 169 matching lines @@
         if (functionDef.name in mod) {
           throw new Error('Function ' + functionDef.name +
                           ' already defined in ' + schema.namespace);
         }
 
         if (!isSchemaNodeSupported(functionDef, platform, manifestVersion)) {
           this.apiFunctions_.registerUnavailable(functionDef.name);
           return;
         }
 
-        var apiFunction = {};
+        var apiFunction = { __proto__: null };

[robwu, 2016/04/21 10:29:33]

With this change, the separate apiFunctionName variable is not needed any more,
so consider using apiFunction.name again to improve readability.

[Devlin, 2016/04/21 18:28:30]

Done.

         apiFunction.definition = functionDef;
         var apiFunctionName = schema.namespace + '.' + functionDef.name;
         apiFunction.name = apiFunctionName;
 
         if (!GetAvailability(apiFunctionName).is_available ||
             (checkUnprivileged && !isSchemaAccessAllowed(functionDef))) {
           this.apiFunctions_.registerUnavailable(functionDef.name);
           return;
         }
 
@@ skipping 162 matching lines @@
                     availability.message);
       return;
     }
 
     this.runHooks_(mod, schema);
     return mod;
   }
 };
 
 exports.$set('Binding', Binding);