Dangerous constructors, nasty monkey patching

Many coders think of code as legos, not taking their inner workings into account until something goes wrong. This is particurally concerning for factory constructors that are not specifically coded for the business needs of the consumer and utalize fields that the developer may or may not be aware of. These can invoke deconstructors which can be harmful to the stability of the computer. This occurs through encapsulation and is known as constructor poisoning somrtimes using monkey patching. Wikipedia defines monkey patching as "a way to extend or modify the runtime code of dynamic languages (e.g. Smalltalk, JavaScript, Objective-C, Ruby, Perl, Python, Groovy, etc.) without altering the original source code". One way of monkey patching is using the corflags.

Wikipedia goes on to say there are vulnerabilities such as

• Replace methods/attributes/functions at runtime.
• Modify/extend behavior of a third-party product without maintaining a private copy of the source code.
• Apply a patch at runtime to the objects in memory, instead of the source code on disk.
• Distribute security or behavioral fixes that live alongside the original source code.

In 31 March of 2017 the Register Magazine published a story regarding the Windows 2003 server IIS server and Microsoft does not want to fix this end of life product (https://m.theregister.co.uk/2017/03/31/microsoft_wont_patch_server_2003/). This vulnerability is posted on Github here: https://github.com/edwardz246003/IIS_exploit Another exploit that uses this is MS15-034.

When manipulating the global assembly cache that synch between servers that are in large corporations such as internet service providers, One of the most prevelent web exploits is Blackhole in 2012. https://renouncedthoughts.wordpress.com/2013/01/04/exploring-and-manipulating-the-gac/
Because the 32 bit runtime is not checked as often as the 64 bit and the 32 bit version is not checked as often, there are malware distributed specifically to 32 bit computers this way. One such example is the Darkknight Trojan discovered in early September of 2017 according to Threatexpert. This code lives in appdata and displays fake error messages to the user in hopes they click "OK". http://www.threatexpert.com/report.aspx?md5=897cd0d6eed8cbf379abb957d313014e

Ways of limiting declarations in JavaScript ES 6 is to know the difference between let, var, and const. The difference can mean deadspace or the subtle linking of libraries that can be malicious.

The const is defined by Mozilla as "The const declaration creates a read-only reference to a value. It does not mean the value it holds is immutable, just that the variable identifier cannot be reassigned. For instance, in the case where the content is an object, this means the object's contents (e.g., its parameters) can be altered.

All the considerations about the "temporal dead zone" apply to both let and const. The difference is scoping. var is scoped to the nearest function block and let is scoped to the nearest enclosing block, which can be smaller than a function block. Both are global if outside any block.

A constant cannot share its name with a function or variable in the same scope.

According to https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/let

let allows you to declare variables that are limited in scope to the block, statement, or expression on which it is used. This is unlike the var keyword, which defines a variable globally, or locally to an entire function regardless of block scope.

On stack exchange exebook writes about how the let name is chosen "

down voteaccepteLet is a mathematical statement that was adopted by early programming languages like Scheme and Basic. Variables are considered low level entities not suitable for higher levels of abstraction, thus the desire of many language designers to introduce similar but more powerful concepts like in Clojure, F#, Scala, where let might mean a value, or a variable that can be assigned, but not changed, which in turn lets the compiler catch more programming errors and optimize code better. JavaScript has had var from the beginning, so they just needed another keyword, and just borrowed from dozens of other languages that use let already as a traditional keyword as close to var as possible, although in JavaScript let creates block scope local variable instea

down voteaccep

Let is a mathematical statement that was adopted by early programming languages like Scheme and Basic. Variables are considered low level entities not suitable for higher levels of abstraction, thus the desire of many language designers to introduce similar but more powerful concepts like in Clojure, F#, Scala, where let might mean a value, or a variable that can be assigned, but not changed, which in turn lets the compiler catch more programming errors and optimize code better. JavaScript has had var from the beginning, so they just needed another keyword, and just borrowed from dozens of other languages that use let already as a traditional keyword as close to var as possible, although in JavaScript let creates block scope local variable instead.

The let variable can be but not necessary recommended to be backfilled. It can also enumerate constructors without using clojure.

Mozilla defines var as Variable declarations, wherever they occur, are processed before any code is executed. The scope of a variable declared with var is its current execution context, which is either the enclosing function or, for variables declared outside any function, global. If you re-declare a JavaScript variable, it will not lose its value.

http://www.rubypigeon.com/posts/4-ways-to-avoid-monkey-patching/

https://github.com/getify/You-Dont-Know-JS/blob/master/scope%20%26%20closures/ch3.md

https://stackoverflow.com/questions/762011/whats-the-difference-between-using-let-and-var-to-declare-a-variable

http://www.reigndropsfall.net/2010/06/15/monkey-patching/

https://hacks.mozilla.org/2015/07/es6-in-depth-let-and-const/

https://blog.mozilla.org/addons/2015/10/14/breaking-changes-let-const-firefox-nightly-44/