[Extensions] Sprinkle in some more null protos and defineProperty's

extensions/renderer/resources/binding.js

Index: extensions/renderer/resources/binding.js
diff --git a/extensions/renderer/resources/binding.js b/extensions/renderer/resources/binding.js
index 13ac7f960ccd89e28d61d7e52ca65baded2c8451..5887b1d038b6ff5d3eabce0fee4f296f9d57b5f8 100644
--- a/extensions/renderer/resources/binding.js
+++ b/extensions/renderer/resources/binding.js
@@ -26,11 +26,15 @@ var sendRequest = sendRequestHandler.sendRequest;
 // modify their behaviour (such as a custom way to handle requests to the
 // API, a custom callback, etc).
 function APIFunctions(namespace) {
-  this.apiFunctions_ = {};
-  this.unavailableApiFunctions_ = {};
+  this.apiFunctions_ = { __proto__: null };
+  this.unavailableApiFunctions_ = { __proto: null };

[robwu, 2016/04/21 10:29:33]

Typo: __proto -> __proto__.

[Devlin, 2016/04/21 18:28:30]

D'oh, done.

   this.namespace = namespace;
 }
 
+APIFunctions.prototype = {
+  __proto__: null,
+};
+
 APIFunctions.prototype.register = function(apiName, apiFunction) {
   this.apiFunctions_[apiName] = apiFunction;
 };
@@ -184,9 +188,12 @@ function Binding(apiName) {
   this.customHooks_ = [];
 };
 
-Binding.create = function(apiName) {
-  return new Binding(apiName);
-};
+$Object.defineProperty(Binding, 'create', {

[robwu, 2016/04/21 10:29:33]

Also use __proto__: null in the property descriptor if you want to make sure
that this call doesn't throw. E.g. if a script does the following before
activating extension bindings, then defineProperty would throw:

Object.prototype.get = 'anything';

[Devlin, 2016/04/21 18:28:30]

I'm not as worried about avoiding throwing at the moment (it's actually pretty
trivial to make bindings throw - if anything is already defined on the object
prototype, we throw at line 377, so doing
Object.defineProperty(Object.prototype, 'connect', ...) would do it).

But, one line change - worth it.  Done.

+  configurable: false,
+  enumerable: false,
+  value: function(apiName) { return new Binding(apiName); },
+  writable: false,
+});
 
 Binding.prototype = {
   // Sneaky workaround for Object.prototype getters/setters - our prototype
@@ -376,7 +383,7 @@ Binding.prototype = {
           return;
         }
 
-        var apiFunction = {};
+        var apiFunction = { __proto__: null };

[robwu, 2016/04/21 10:29:33]

With this change, the separate apiFunctionName variable is not needed any more,
so consider using apiFunction.name again to improve readability.

[Devlin, 2016/04/21 18:28:30]

Done.

         apiFunction.definition = functionDef;
         var apiFunctionName = schema.namespace + '.' + functionDef.name;
         apiFunction.name = apiFunctionName;