Skip to content

Commit

Permalink
Order alternatives to using document for globals preferentially
Browse files Browse the repository at this point in the history
Most preferable is no globals, then assigning explicitly to window/globalThis, then using `var` (because it hoists), and last writing `x=1`.
  • Loading branch information
ericcornelissen authored Nov 7, 2024
1 parent 0a78096 commit fc75d65
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion domc_wiki/indicators/patterns.md
Original file line number Diff line number Diff line change
Expand Up @@ -47,9 +47,9 @@ Another common mistake enabling DOM Clobbering is treating DOM properties, like
Properties of `document` can always be overwritten by DOM Clobbering, even immediately after they are assigned a value, as in pattern C. Accordingly, developers should refrain from using `document` as a means to store and retrieve global values. Instead, they can:

- rewrite their application to avoid global values.
- explicitly add them as properties on `window` (or [`globalThis`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis)), e.g. `window.x=1` - making sure to avoid pattern G and H.
- use `var` (NOT `let` nor `const`) in the global context to define global values, e.g. `var x=1` - making sure to avoid pattern A, B, and F.
- initialize global values without `var` (nor `let or `const`), e.g. `x=1` - making sure to avoid pattern E, G, and H.
- explicitly add them as properties on `window` (or [`globalThis`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis)), e.g. `window.x=1` - making sure to avoid pattern G and H.

The following table shows how declerations affect global value access patterns in the precense of DOM Clobbering.

Expand Down

0 comments on commit fc75d65

Please sign in to comment.