Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I recently came across the following code (from liferay.js) when I was working with Liferay:

....
if (!Liferay._ajaxOld) {
    Liferay._ajaxOld = jQuery.ajax;
}

if (Liferay._ajaxOld) {
    jQuery.ajax = function(options) {
        if (Liferay.Util) {
            options.url = Liferay.Util.getURLWithSessionId(options.url);
        }
        return Liferay._ajaxOld(options);
    };
}
....

As you can see, the code above overwrites the function "jQuery.ajax" to modify "options.url". One may say this is a strength of the language since we can easily overwrite and customize existing functions.

However, I would imagine this capability can easily lead to a problem. For instance, my code can overwrite the same function "jQuery.ajax" to modify "options.url" differently from the code above. As a result, any code that expect the behavior defined by "liferay.js" may no longer function as expected.

I see this as a weakness of the language as it does not provide proper encapsulation. What are the consensus about this feature/capability of the language in the field?

share|improve this question

migrated from stackoverflow.com Nov 11 '11 at 22:13

This question came from our site for professional and enthusiast programmers.

    
Consensus, that's funny. Obviously it's both a strength and weakness, but JS can be written to make it irritating to overwrite functionality. –  Dave Newton Nov 10 '11 at 22:31
1  
You are not overwriting a function so much as you are re-assigning a variable. You could just as easily reassign it to 2 or 'Hello'. This is also why jQuery comes with the .noConflict() function. –  Andrew Nov 10 '11 at 22:37
    
That's called function clobbering -- it's good in some cases, but not always. –  good_computer Nov 12 '11 at 5:53

3 Answers 3

I think it really depends on who you ask. Javascript is by no means a perfect language, but just like abstraction of private variables, this may be a good or bad thing depending on the situtation.

If you're using a library and want to overwrite a function, then it's a good thing, if you're the author of a library or function, and someone uses your code in a way you do not intend, then it is not.

share|improve this answer

It's a strength. If you are modifying an existing function then you know what that modified function does and you know to use it differently than the spec and not to follow with code that uses the old spec.

It's not like it overwrites the function in the interpreter itself so other web pages will use the modified spec.

One advantage to this is you can fix minor bugs in a library that exists on a CDN without needing to keep and serve an entire copy of the library local.

One place where this may be of benefit is with Content Security Policy (CSP) environments. Since jQuery animations often use the style attribute which may be forbidden in a CSP environment, you may want to rewrite some of jQueries functions to point to an external CSS3 sheet and assign class attributes instead. Thus you could keep using jQuery with the huge library hosted on the CDN, have a small js locally hosted that redefines the jQuery functions that violate your CSP in a way that does not violate your CSP, and use packaged widgets that call those functions without needing to modify the packaged widgets.

share|improve this answer
    
Thanks, my concern is about security. I would imagine jQuery.ajax is one of the prime target for those who wish to abuse this feature for their own purpose since its popularity. I am not aware what sort of abuse we can make, but this makes me wonder if we should scan all the third party libraries for overwriting functions? –  S.N Nov 10 '11 at 22:50

Like many powerful language-features, it's a double edged sword. It both can be very useful (see aspect-oriented programming) and lead to subtle bugs.

share|improve this answer
    
Thanks, in the case of AOP, I am in charge if my code should be advised. However, this feature/capability with JavaScript, things are out of my control. For instance, any third party can hijack jQuery.ajax. So far, JavaScript seems to be in-disciplined language compared to Java. Yet, the language is gaining its popularity. So, I am very curious to hear what other people think about the language. –  S.N Nov 10 '11 at 23:09
    
@S.N: Any code that runs client side has access to client side data and runs in the context of the page it's attached to, whether it hooks into existing functions or not. That properties are dynamic is not itself a vulnerability. Encapsulation and information hiding are not security features, they're about managing code & data dependencies. In Java, reflection can be used to access private members. Methods can be replaced in compiled clases. –  outis Nov 11 '11 at 5:39
1  
... As for JS gaining popularity, it already has it. However, it's used for different types of projects than Java; the two are apples and oranges. Security vulnerabilities relating to JS are cross site scripting and cross site request forgery, neither of which is based on dynamic property redefinition. –  outis Nov 11 '11 at 5:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.