# Prototype constructor override

**URL:** <https://es.discourse.group/t/prototype-constructor-override/237>\
**Category:** 💡 Ideas\
**Created:** [February 25, 2020, 3:21am UTC](https://es.discourse.group/t/prototype-constructor-override/237 "2020-02-25T03:21:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mnini](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/mnini/32/253_2.png) [@mnini](https://es.discourse.group/u/mnini)\
**Post date:** [February 25, 2020, 3:21am UTC](https://es.discourse.group/t/prototype-constructor-override/237/1 "2020-02-25T03:21:49Z")

</div>

Possibility to rewire strings or arrays constructor in the prototype, so I could control the object created by []

---

<div class="post-metadata">

**Author:** ![mnini](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/mnini/32/253_2.png) [@mnini](https://es.discourse.group/u/mnini)\
**Post date:** [February 25, 2020, 3:39am UTC](https://es.discourse.group/t/prototype-constructor-override/237/2 "2020-02-25T03:39:52Z")

</div>

class Arr {  
constructor(dim, arr) {  
console.log(dim, arr)  
let i  
for(i = 0; i \< arr.length; i++) {  
this[i] = arr[i]  
}  
this.dim = 0  
this.ite = 0  
}  
[Symbol.iterator] () {  
return this.getNewIterator()  
}  
getNewIterator() {  
return new ArrIterator(this)  
}  
}  
class ArrIterator {  
constructor(arr) {  
this.arr = arr  
this.pos = 0  
}  
next() {  
return this.arr[this.pos++]  
}  
}

Array.prototype.constructor = function(...args) {  
console.log(args)  
}  
Array.prototype = Object.entries(Array.prototype, Arr)  
let k = [7]

Args is an empty array, however it is initialized with 7 therefore it should be passed inside a constructor.

---

<div class="post-metadata">

**Author:** ![ljharb](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/ljharb/32/8_2.png) [@ljharb](https://es.discourse.group/u/ljharb)\
**Post date:** [February 25, 2020, 4:40am UTC](https://es.discourse.group/t/prototype-constructor-override/237/3 "2020-02-25T04:40:46Z")

</div>

You can do `Object.setPrototypeOf(arr, whatever)`, or you can subclass `Array`.

---

<div class="post-metadata">

**Author:** ![bergus](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/bergus/32/152_2.png) [@bergus](https://es.discourse.group/u/bergus)\
**Post date:** [February 26, 2020, 12:09am UTC](https://es.discourse.group/t/prototype-constructor-override/237/4 "2020-02-26T00:09:24Z")

</div>

> [@mnini](#):
>
> I could control the object created by

That was possible (to some extent) long ago, and [posed a significant security issue](https://haacked.com/archive/2009/06/25/json-hijacking.aspx/).

---

<div class="post-metadata">

**Author:** ![mnini](https://yyz2.discourse-cdn.com/free1/user_avatar/es.discourse.group/mnini/32/253_2.png) [@mnini](https://es.discourse.group/u/mnini)\
**Post date:** [February 28, 2020, 4:45pm UTC](https://es.discourse.group/t/prototype-constructor-override/237/5 "2020-02-28T16:45:02Z")

</div>

Yes, I noticed people stopped using databases because of SQL injection. Or didn't I? Simply filter incoming JSON for prototype keyword and nothing gets on the server... In sane object there is no key either.

Simple recursive function or while loop can solve whole security issue, it's like removing windows from house because intruders can get in while they're open.

It was for sure mistake in implementation.

We should have two types of JSONs in-house and out-house.  
Also API look more beautiful using YAML or similar, simpler formats.

Writing encoder that is suitable for most API's takes few days at most and you can have format that is readable far much more, and doesn't use object names more than twice.

You can use just space to separate data or binary unicode separator character, and safe many many bits, while still being compatible with browser, because encoder/decoder is javascript.

Literally creating format that separates headers from encoded text ( something like Apach Arrow approach to data, where names are just once ) can easily cure whole this issue.

I wrote file format like that somehow long time ago, but if you still have issues like dissease because you don't wash your hands... Maybe the problem is not ability to touch a pathogen.