# New forbidden rule: No leaking Proxy

**URL:** <https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646>\
**Category:** 💡 Ideas\
**Created:** [February 16, 2021, 3:16pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646 "2021-02-16T15:16:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JackWorks](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/jackworks/32/260_2.png) [@JackWorks](https://es.discourse.group/u/JackWorks)\
**Post date:** [February 16, 2021, 3:16pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/1 "2021-02-16T15:16:32Z")

</div>

In Firefox, it is possible to detect if an object is a proxy. I think this is not what we want (maybe cc @markm ?)

 ![image](https://global.discourse-cdn.com/free1/uploads/es/original/1X/5777ae00995058a82c30172cce72fb4d7b96c202.png)

I think we should forbid engines to leak if an object is a proxy or not in any manner (e.g. Error message)

---

<div class="post-metadata">

**Author:** ![JackWorks](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/jackworks/32/260_2.png) [@JackWorks](https://es.discourse.group/u/JackWorks)\
**Post date:** [February 16, 2021, 3:20pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/2 "2021-02-16T15:20:18Z")

</div>

V8 also leaks this kind of information via the error stack

 ![image](https://global.discourse-cdn.com/free1/uploads/es/original/1X/7e065f4ef41a091e24e1d56c9929be3b9961e86c.jpeg)

---

<div class="post-metadata">

**Author:** ![ljharb](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/ljharb/32/8_2.png) [@ljharb](https://es.discourse.group/u/ljharb)\
**Post date:** [February 16, 2021, 3:29pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/3 "2021-02-16T15:29:54Z")

</div>

It’s always possible to detect if a proxy around “a builtin with internal slots” is a proxy. Proxy isn’t meant to be used by itself, it’s meant to be used as part of a membranes implementation.

Internal slots (like private fields, and identity) don’t tunnel through proxies, and that is very much by design.

---

<div class="post-metadata">

**Author:** ![JasonHK](https://avatars.discourse-cdn.com/v4/letter/j/f05b48/32.png) [@JasonHK](https://es.discourse.group/u/JasonHK)\
**Post date:** [February 16, 2021, 3:32pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/4 "2021-02-16T15:32:15Z")

</div>

Thanks for forwarding my screenshot here. Just created an account to track the post.

In addition to `String`, `.prototype.valueOf` method of other native objects (such as `Number` and `Date`) works as well.

---

<div class="post-metadata">

**Author:** ![JackWorks](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/jackworks/32/260_2.png) [@JackWorks](https://es.discourse.group/u/JackWorks)\
**Post date:** [February 16, 2021, 3:45pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/5 "2021-02-16T15:45:00Z")

</div>

What I want is: the engine just reports "incompatible receiver" without revealing their brand.

---

<div class="post-metadata">

**Author:** ![ljharb](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/ljharb/32/8_2.png) [@ljharb](https://es.discourse.group/u/ljharb)\
**Post date:** [February 16, 2021, 4:29pm UTC](https://es.discourse.group/t/new-forbidden-rule-no-leaking-proxy/646/6 "2021-02-16T16:29:33Z")

</div>

The exception reveals the brand, because the user knows which prototype method they .called on it. The contents of the message are both never specified by ECMAScript, and are also not relevant to the information being exposed.