New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

lel

Package Overview
Dependencies
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

lel - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

vim.exe.stackdump

2

package.json
{
"name": "lel",
"version": "1.0.0",
"version": "1.0.1",
"description": "A package that makes Promise great again!",

@@ -5,0 +5,0 @@ "main": "index.js",

# Potentially dangerous behavior from Promises
Promises seem to try and find it a value has the method .then before wrapping it to pass it in the resolve/reject callbacks.
Its like duck typing, except in this case its not good enough.
I found about about this after I found out about the problem the hard way, but go [read the spec](https://promisesaplus.com/), and especially the part about thenables and ```The Promise Resolution Procedure```
```“thenable” is an object or function that defines a then method.```
Here's how I found out about the problem, and what happens exactly
(you can test this code on [jsbin](http://jsbin.com/qizexuredo/edit?js,console))

@@ -36,3 +35,3 @@

I initially found out about this while experimenting with Proxies and thought the issue was with their implementation, but as you can see in the following code (and this [jsbin](http://jsbin.com/reyococeca/edit?js,console)) it is really in the Promise implementation, and happens at least on Firefox/Chrome.
I initially found out about this while experimenting with Proxies and thought the issue was with their implementation, but as you can see in the following code (and this [jsbin](http://jsbin.com/reyococeca/edit?js,console)) it is really in the Promise implementation [edit : spec].

@@ -64,5 +63,2 @@ ```js

As you can see, I have been overprotective with this code, on purpose.
What it shows is that you have *no way* to know where the problem comes from.
# The end of the world

@@ -80,2 +76,30 @@

# Debugging
As you can see, I have been overprotective with the bits of code above, on purpose.
What it shows is that you have *no way* to know where the problem comes from.
The reason for that is the Promise will never resolve nor reject.
A thenable's then function is given the resolve|reject callbacks and should act on it like so :
```js
let obj = {
then : (resolve, reject) => {
resolve(42)
}
}
Promise.resolve(obj)
.then(value => {
console.log(value) // 42
})
```
Otherwise, you now know what happens.
There's no fix for this, and if someone decides to play bad with this stuff, you're in for a hell of a debugging session.
Yay js, I guess...
# Warnings

@@ -82,0 +106,0 @@

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc