Skip to content

Instantly share code, notes, and snippets.

@dfkaye
dfkaye / proto-pollution.js
Last active June 30, 2025 03:36
prototype pollution in javascript - sources, detection, defenses
// 16-21 April 2022
// prototype pollution in JavaScript - sources, detection, defenses
// [ draft in progress... ]
// Every object has this property: __proto__.
// The __proto__ property has been deprecated officially since 2015 but is still supported everywhere.
// The __proto__ property points to the object's constructor's prototype property.
// Every prototype is a property of a constructor function
// For example, `"a string".constructor.prototype` is `String.prototype` which inherits from `Object.prototype` and contains a few of its own properties.
@dfkaye
dfkaye / Number.toFixed.blog.md
Last active April 27, 2025 17:30
[ work in progress ] Test & polyfill-fix for JavaScript Number.toFixed() bugs; e.g., (1.015).toFixed(2) returns "1.01" instead of "1.02"

Number.toFixed() rounding errors: broken but fixable

wordpress post

I found a rounding bug in Number.toFixed() in every JavaScript environment I've tried (Chrome, Firefox, Internet Explorer, Brave, and Node.js). The fix is surprisingly simple. Read on…

Warm up

I found this version of the rounding bug in toFixed() while revising a number-formatting function that performs the same kind of thing as Intl.NumberFormat#format().

(1.015).toFixed(2) // => returns "1.01" instead of "1.02"

@dfkaye
dfkaye / safe-eval-workers.md
Last active April 11, 2025 05:17
Use a Worker() for eval() and Function() when Content-Security-Policy does not allow 'unsafe-eval'
@dfkaye
dfkaye / js-get-fn-name.js
Last active January 21, 2025 17:45
get a javascript function name
function getFnName(fn) {
fn = Object(fn)
var F = typeof fn == 'function'
var N = fn.name
var S = F && ((N && ['', N]) || fn.toString().match(/function ([^\(]+)/))
return (!F && 'not a function') || (S && S[1] || 'anonymous');
}
console.log(getFnName(String)); // 'String'
console.log(getFnName(function test(){})); // 'test'
@dfkaye
dfkaye / Hash.js
Created March 6, 2022 02:54
Use crypto subtle digest to create hash hex string
// 5 March 2022
// Using window.crypto.subtle.digest()
// @param "sha-256" or other algorithm
// @param DataView with ArrayBuffer or just ArrayBuffer
// Not my own.
// Copy+paste+modified from
// https://stackoverflow.com/a/68545495
@dfkaye
dfkaye / multiple-inheritance.js
Created August 18, 2024 08:18
simulate multiple inheritance in javascript
// 5 Aug 2024
// multiple inheritance
// "inspired" by tweet, 1 August 2024, from Colin McDonnell (and goaded by some
// benighted replies) at https://x.com/colinhacks/status/1819138095104905689
// Challenge: Implement merge() to handle multiple inheritance, as per example:
// ```
// class A {...}
// class B {...}
@dfkaye
dfkaye / chunked-response-stream.js
Created August 18, 2024 08:17
simulate chunked HTML response stream in the browser
// 15 July 2024
// simulate chunked HTML response stream in the browser
// 1. create the response stream parts
var encoder = new TextEncoder;
var text = `
<html lang="en">
@dfkaye
dfkaye / parse-bigint.js
Created August 18, 2024 08:15
parse bigint
// 1 July 2024
// parseBigInt
function parseBigInt(b, r) {
var n = String(b).split("n")[0];
return parseInt(n, r);
}
var base10 = ["2n.3", "5.5", "FFnA", "n.3"].map(function (v, i) {
return parseBigInt(v, 8);
@dfkaye
dfkaye / is-number-or-bigint.js
Created August 18, 2024 08:14
is-number with bigint support
// 22 June 2024
// is-number with bigint support
function isNumber(n) {
var m = typeof n == 'bigint'
? 0n
: 0;
return n - m === Object(n).valueOf();
}
@dfkaye
dfkaye / partial-order-timestamps.js
Created August 18, 2024 08:13
partial order timestamps, realizing the algorithm for processing event timestamps in Fidge (1988)
// 12 June 2024
// realizing the algorithm for processing event timestamps in Fidge (1988),
// "Timestamps in Message-Passing Systems That Preserve the Partial Ordering"
// https://fileadmin.cs.lth.se/cs/Personal/Amr_Ergawy/dist-algos-papers/4.pdf
// missing the query or aggregation step that collects the timestamps and sorts
// them by determinate vs. non-determinate ordering.
// determinate ordering should be singular (i.e., only one permutation) whereas