A nice article, I have been trying to learn more about javascript recently, and the section about "this" reminded me about a nice moment I had while tring to learn.
I used to get confused about how the "this" binding worked in javascript. My moment of clarity came when I tried to do something like this:
Doing this kind of thing didnt work with the conceptual model of "this" I had from my years of C# where functions are bound to objects.
Then I realised that ofcourse the object referred to by "this" would have to change, how else would it be implemented when you have first-class functions that can be passed around freely without a lexically captured "this"?
Now I see as "this" more of an attempt to keep familiar syntax than something that fits with the semantics of the language. It really seems more of a call-context.
That section on Javascript security is pretty brief, I'd like to add some others from websites that I've tested:
* Take document.location.href and document.location.hash as unsanitised input especially if they're affecting DOM.
* Avoid using innerHTML or jQuery's .append(), they slow down the page with reflow and make it easier to inject code into the page.
* Always write regex to match the minimum it needs to; Javascript code is visible to the client and therefore anyone who wishes to find and abuse exploits, completely avoiding iterative testing to determine regexes that generate links and other code.
* Remember that because jQuery has a lot of syntactic sugar, doing $("#bac" + myString) can do a lot more than just select from a set of similarly id'd nodes.
This is from Douglas Crockford's talk, "An Inconvenient API - The Theory of the DOM," which is perhaps the best title ever for a programming lecture. The way he adapted Al Gore's cover art is so inspired, it's just sheer perfection.
someObject.someFunc = anotherObject.someOtherFunc;
Doing this kind of thing didnt work with the conceptual model of "this" I had from my years of C# where functions are bound to objects. Then I realised that ofcourse the object referred to by "this" would have to change, how else would it be implemented when you have first-class functions that can be passed around freely without a lexically captured "this"?
Now I see as "this" more of an attempt to keep familiar syntax than something that fits with the semantics of the language. It really seems more of a call-context.