Fix name of JavaScript

This commit is contained in:
Alexey Pyltsyn 2019-04-23 11:51:28 +03:00
parent 3b14ed8185
commit c5ce5578fc
32 changed files with 61 additions and 61 deletions

View file

@ -45,7 +45,7 @@ The engine applies optimizations at each step of the process. It even watches th
Modern JavaScript is a "safe" programming language. It does not provide low-level access to memory or CPU, because it was initially created for browsers which do not require it.
Javascript's capabilities greatly depend on the environment it's running in. For instance, [Node.JS](https://wikipedia.org/wiki/Node.js) supports functions that allow JavaScript to read/write arbitrary files, perform network requests, etc.
JavaScript's capabilities greatly depend on the environment it's running in. For instance, [Node.JS](https://wikipedia.org/wiki/Node.js) supports functions that allow JavaScript to read/write arbitrary files, perform network requests, etc.
In-browser JavaScript can do everything related to webpage manipulation, interaction with the user, and the webserver.
@ -88,7 +88,7 @@ There are at least *three* great things about JavaScript:
+ Simple things are done simply.
+ Support by all major browsers and enabled by default.
```
Javascript is the only browser technology that combines these three things.
JavaScript is the only browser technology that combines these three things.
That's what makes JavaScript unique. That's why it's the most widespread tool for creating browser interfaces.

View file

@ -221,7 +221,7 @@ function sayHiBye(firstName, lastName) {
}
```
Here the *nested* function `getFullName()` is made for convenience. It can access the outer variables and so can return the full name. Nested functions are quite common in Javascript.
Here the *nested* function `getFullName()` is made for convenience. It can access the outer variables and so can return the full name. Nested functions are quite common in JavaScript.
What's much more interesting, a nested function can be returned: either as a property of a new object (if the outer function creates an object with methods) or as a result by itself. It can then be used somewhere else. No matter where, it still has access to the same outer variables.
@ -473,7 +473,7 @@ The code outside of the block (or inside another script) doesn't see variables i
### IIFE
In the past, there were no block-level lexical environment in Javascript.
In the past, there were no block-level lexical environment in JavaScript.
So programmers had to invent something. And what they did is called "immediately-invoked function expressions" (abbreviated as IIFE).

View file

@ -79,7 +79,7 @@ No, it's not, because it may lead to naming conflicts: the same variable name ca
As of now, the multi-purpose `window` is considered a design mistake in the language.
Luckily, there's a "road out of hell", called "Javascript modules".
Luckily, there's a "road out of hell", called "JavaScript modules".
If we set `type="module"` attribute on a `<script>` tag, then such script is considered a separate "module" with its own top-level scope (lexical environment), not interfering with `window`.

View file

@ -3,7 +3,7 @@
In the first chapter of this section, we mentioned that there are modern methods to setup a prototype.
The `__proto__` is considered outdated and somewhat deprecated (in browser-only part of the Javascript standard).
The `__proto__` is considered outdated and somewhat deprecated (in browser-only part of the JavaScript standard).
The modern methods are:
@ -81,7 +81,7 @@ Why was `__proto__` replaced by the functions? That's an interesting question, r
```warn header="Don't reset `[[Prototype]]` unless the speed doesn't matter"
Technically, we can get/set `[[Prototype]]` at any time. But usually we only set it once at the object creation time, and then do not modify: `rabbit` inherits from `animal`, and that is not going to change.
And JavaScript engines are highly optimized to that. Changing a prototype "on-the-fly" with `Object.setPrototypeOf` or `obj.__proto__=` is a very slow operation, it breaks internal optimizations for object property access operations. So evade it unless you know what you're doing, or Javascript speed totally doesn't matter for you.
And JavaScript engines are highly optimized to that. Changing a prototype "on-the-fly" with `Object.setPrototypeOf` or `obj.__proto__=` is a very slow operation, it breaks internal optimizations for object property access operations. So evade it unless you know what you're doing, or JavaScript speed totally doesn't matter for you.
```
## "Very plain" objects

View file

@ -68,7 +68,7 @@ So, what exactly is a `class`? That's not an entirely new language-level entity
Let's unveil any magic and see what a class really is. That'll help in understanding many complex aspects.
In Javascript, a class is a kind of a function.
In JavaScript, a class is a kind of a function.
Here, take a look:

View file

@ -55,9 +55,9 @@ In JavaScript, there are three types of properties and members:
In many other languages there also exist "protected" fields: accessible only from inside the class and those extending it. They are also useful for the internal interface. They are in a sense more widespread than private ones, because we usually want inheriting classes to gain access to properly do the extension.
Protected fields are not implemented in Javascript on the language level, but in practice they are very convenient, so they are emulated.
Protected fields are not implemented in JavaScript on the language level, but in practice they are very convenient, so they are emulated.
In the next step we'll make a coffee machine in Javascript with all these types of properties. A coffee machine has a lot of details, we won't model them to stay simple (though we could).
In the next step we'll make a coffee machine in JavaScript with all these types of properties. A coffee machine has a lot of details, we won't model them to stay simple (though we could).
## Protecting "waterAmount"
@ -186,7 +186,7 @@ So protected fields are naturally inheritable. Unlike private ones that we'll se
[recent browser=none]
There's a finished Javascript proposal, almost in the standard, that provides language-level support for private properties and methods.
There's a finished JavaScript proposal, almost in the standard, that provides language-level support for private properties and methods.
Privates should start with `#`. They are only accessible from inside the class.
@ -325,6 +325,6 @@ Hiding complexity
To hide internal interface we use either protected or public properties:
- Protected fields start with `_`. That's a well-known convention, not enforced at the language level. Programmers should only access a field starting with `_` from its class and classes inheriting from it.
- Private fields start with `#`. Javascript makes sure we only can access those from inside the class.
- Private fields start with `#`. JavaScript makes sure we only can access those from inside the class.
Right now, private fields are not well-supported among browsers, but can be polyfilled.

View file

@ -30,7 +30,7 @@ As said in the [specification](https://tc39.github.io/ecma262/#sec-jobs-and-job-
- The queue is first-in-first-out: tasks enqueued first are run first.
- Execution of a task is initiated only when nothing else is running.
Or, to say that simply, when a promise is ready, its `.then/catch/finally` handlers are put into the queue. They are not executed yet. Javascript engine takes a task from the queue and executes it, when it becomes free from the current code.
Or, to say that simply, when a promise is ready, its `.then/catch/finally` handlers are put into the queue. They are not executed yet. JavaScript engine takes a task from the queue and executes it, when it becomes free from the current code.
That's why "code finished" in the example above shows first.
@ -54,7 +54,7 @@ Now the order is as intended.
## Event loop
In-browser Javascript, as well as Node.js, is based on an *event loop*.
In-browser JavaScript, as well as Node.js, is based on an *event loop*.
"Event loop" is a process when the engine sleeps and waits for events, then reacts on those and sleeps again.

View file

@ -12,7 +12,7 @@ async function f() {
}
```
The word "async" before a function means one simple thing: a function always returns a promise. Even If a function actually returns a non-promise value, prepending the function definition with the "async" keyword directs Javascript to automatically wrap that value in a resolved promise.
The word "async" before a function means one simple thing: a function always returns a promise. Even If a function actually returns a non-promise value, prepending the function definition with the "async" keyword directs JavaScript to automatically wrap that value in a resolved promise.
For instance, the code above returns a resolved promise with the result of `1`, let's test it:

View file

@ -5,7 +5,7 @@ There are many areas where we need random data.
One of them is testing. We may need random data: text, numbers etc, to test things out well.
In Javascript, we could use `Math.random()`. But if something goes wrong, we'd like to be able to repeat the test, using exactly the same data.
In JavaScript, we could use `Math.random()`. But if something goes wrong, we'd like to be able to repeat the test, using exactly the same data.
For that, so called "seeded pseudo-random generators" are used. They take a "seed", the first value, and then generate next ones using a formula. So that the same seed yields the same sequence, and hence the whole flow is easily reproducible. We only need to remember the seed to repeat it.

View file

@ -462,7 +462,7 @@ If we don't catch the error there, then, as usual, it falls through to the outer
- Inside generators (only) there exists a `yield` operator.
- The outer code and the generator may exchange results via `next/yield` calls.
In modern Javascript, generators are rarely used. But sometimes they come in handy, because the ability of a function to exchange data with the calling code during the execution is quite unique.
In modern JavaScript, generators are rarely used. But sometimes they come in handy, because the ability of a function to exchange data with the calling code during the execution is quite unique.
Also, in the next chapter we'll learn async generators, which are used to read streams of asynchronously generated data in `for` loop.

View file

@ -130,7 +130,7 @@ That's natural, as it expects to find `Symbol.iterator`, same as `for..of` witho
## Async generators
Javascript also provides generators, that are also iterable.
JavaScript also provides generators, that are also iterable.
Let's recall a sequence generator from the chapter [](info:generators). It generates a sequence of values from `start` to `end` (could be anything else):
@ -358,4 +358,4 @@ In web-development we often meet streams of data, when it flows chunk-by-chunk.
We could use async generators to process such data, but there's also another API called Streams, that may be more convenient, as it provides special interfaces to transform the data and to pass it from one stream to another (e.g. download from one place and immediately send elsewhere). But they are also more complex.
Streams API not a part of Javascript language standard. Streams and async generators complement each other, both are great ways to handle async data flows.
Streams API not a part of JavaScript language standard. Streams and async generators complement each other, both are great ways to handle async data flows.

View file

@ -4,7 +4,7 @@
As our application grows bigger, we want to split it into multiple files, so called 'modules'.
A module usually contains a class or a library of useful functions.
For a long time, Javascript existed without a language-level module syntax. That wasn't a problem, because initially scripts were small and simple. So there was no need.
For a long time, JavaScript existed without a language-level module syntax. That wasn't a problem, because initially scripts were small and simple. So there was no need.
But eventually scripts became more and more complex, so the community invented a variety of ways to organize code into modules.
@ -56,7 +56,7 @@ The browser automatically fetches and evaluates imports, then runs the script.
What's different in modules, compared to "regular" scripts?
There are core features, valid both for browser and server-side Javascript.
There are core features, valid both for browser and server-side JavaScript.
### Always "use strict"
@ -222,7 +222,7 @@ In a module, top-level `this` is undefined, as opposed to a global object in non
There are also several browser-specific differences of scripts with `type="module"` compared to regular ones.
You may want skip those for now if you're reading for the first time, or if you don't use Javascript in a browser.
You may want skip those for now if you're reading for the first time, or if you don't use JavaScript in a browser.
### Module scripts are deferred
@ -259,7 +259,7 @@ Please note: the second script actually works before the first! So we'll see `un
That's because modules are deferred, so way wait for the document to be processed. The regular scripts runs immediately, so we saw its output first.
When using modules, we should be aware that HTML-document can show up before the Javascript application is ready. Some functionality may not work yet. We should put transparent overlays or "loading indicators", or otherwise ensure that the visitor won't be confused because of it.
When using modules, we should be aware that HTML-document can show up before the JavaScript application is ready. Some functionality may not work yet. We should put transparent overlays or "loading indicators", or otherwise ensure that the visitor won't be confused because of it.
### Async works on inline scripts
@ -350,7 +350,7 @@ Build tools do the following:
- Unreachable code removed.
- Unused exports removed ("tree-shaking").
- Development-specific statements like `console` and `debugger` removed.
- Modern, bleeding-edge Javascript syntax may be transformed to older one with similar functionality using [Babel](https://babeljs.io/).
- Modern, bleeding-edge JavaScript syntax may be transformed to older one with similar functionality using [Babel](https://babeljs.io/).
- The resulting file is minified (spaces removed, variables replaced with shorter named etc).
That said, native modules are also usable. So we won't be using Webpack here: you can configure it later.

View file

@ -29,7 +29,7 @@ For instance, here all exports are valid:
````smart header="No semicolons after export class/function"
Please note that `export` before a class or a function does not make it a [function expression](info:function-expressions-arrows). It's still a function declaration, albeit exported.
Most Javascript style guides recommend semicolons after statements, but not after function and class declarations.
Most JavaScript style guides recommend semicolons after statements, but not after function and class declarations.
That's why there should be no semicolons at the end of `export class` and `export function`.

View file

@ -8,4 +8,4 @@ Create a colored clock like here:
[iframe src="solution" height=60]
Use HTML/CSS for the styling, Javascript only updates time in elements.
Use HTML/CSS for the styling, JavaScript only updates time in elements.

View file

@ -75,7 +75,7 @@ In the example above, we first see "Library loaded...", and then "DOM ready!" (a
```warn header="Scripts with `async`, `defer` or `type=\"module\"` don't block DOMContentLoaded"
Script attributes `async` and `defer`, that we'll cover [a bit later](info:script-async-defer), don't block DOMContentLoaded. [Javascript modules](info:modules) behave like `defer`, they don't block it too.
Script attributes `async` and `defer`, that we'll cover [a bit later](info:script-async-defer), don't block DOMContentLoaded. [JavaScript modules](info:modules) behave like `defer`, they don't block it too.
So here we're talking about "regular" scripts, like `<script>...</script>`, or `<script src="..."></script>`.
```

View file

@ -129,7 +129,7 @@ Async scripts are great when we integrate an independant third-party script into
## Dynamic scripts
We can also create a script dynamically using Javascript:
We can also create a script dynamically using JavaScript:
```js run
let script = document.createElement('script');

View file

@ -23,7 +23,7 @@ document.head.append(script);
...But how to run the function that is declared inside that script? We need to wait until the script loads, and only then we can call it.
```smart
For our own scripts we could use [Javascript modules](info:modules) here, but they are not widely adopted by third-party libraries.
For our own scripts we could use [JavaScript modules](info:modules) here, but they are not widely adopted by third-party libraries.
```
### script.onload

View file

@ -246,7 +246,7 @@ The purpose of the `"sandbox"` attribute is only to *add more* restrictions. It
The `postMessage` interface allows windows to talk to each other no matter which origin they are from.
So, it's a way around the "Same Origin" policy. It allows a window from `john-smith.com` to talk to `gmail.com` and exchange information, but only if they both agree and call corresponding Javascript functions. That makes it safe for users.
So, it's a way around the "Same Origin" policy. It allows a window from `john-smith.com` to talk to `gmail.com` and exchange information, but only if they both agree and call corresponding JavaScript functions. That makes it safe for users.
The interface has two parts.

View file

@ -2,12 +2,12 @@
In web-development we meet binary data mostly while dealing with files (create, upload, download). Another typical use case is image processing.
That's all possible in Javascript, and binary operations are high-performant.
That's all possible in JavaScript, and binary operations are high-performant.
Although, there's a bit of confusion, because there are many classes. To name a few:
- `ArrayBuffer`, `Uint8Array`, `DataView`, `Blob`, `File`, etc.
Binary data in Javascript is implemented in a non-standard way, compared to other languages. But when we sort things out, everything becomes fairly simple.
Binary data in JavaScript is implemented in a non-standard way, compared to other languages. But when we sort things out, everything becomes fairly simple.
**The basic binary object is `ArrayBuffer` -- a reference to a fixed-length contiguos memory area.**
@ -144,7 +144,7 @@ Here's the list of typed arrays:
- `Float32Array`, `Float64Array` -- for signed floating-point numbers of 32 and 64 bits.
```warn header="No `int8` or similar single-valued types"
Please note, despite of the names like `Int8Array`, there's no single-value type like `int`, or `int8` in Javascript.
Please note, despite of the names like `Int8Array`, there's no single-value type like `int`, or `int8` in JavaScript.
That's logical, as `Int8Array` is not an array of these individual values, but rather a view on `ArrayBuffer`.
```

View file

@ -2,7 +2,7 @@
What if the binary data is actually a string? For instance, we received a file with textual data.
The build-in [TextDecoder](https://encoding.spec.whatwg.org/#interface-textdecoder) object allows to read the value into an an actual Javascript string, given the buffer and the encoding.
The build-in [TextDecoder](https://encoding.spec.whatwg.org/#interface-textdecoder) object allows to read the value into an an actual JavaScript string, given the buffer and the encoding.
We first need to create it:
```js

View file

@ -1,6 +1,6 @@
# Blob
`ArrayBuffer` and views are a part of ECMA standard, a part of Javascript.
`ArrayBuffer` and views are a part of ECMA standard, a part of JavaScript.
In the browser, there are additional higher-level objects, described in [File API](https://www.w3.org/TR/FileAPI/).
@ -52,7 +52,7 @@ The arguments are similar to `array.slice`, negative numbers are allowed too.
```smart header="Blobs are immutable"
We can't change data directly in a blob, but we can slice parts of blobs, create new blobs from them, mix them into a new blob and so on.
This behavior is similar to Javascript strings: we can't change a character in a string, but we can make a new corrected string.
This behavior is similar to JavaScript strings: we can't change a character in a string, but we can make a new corrected string.
```
## Blob as URL
@ -72,7 +72,7 @@ link.href = URL.createObjectURL(blob);
</script>
```
We can also create a link dynamically in Javascript and simulate a click by `link.click()`, then download starts authomatically.
We can also create a link dynamically in JavaScript and simulate a click by `link.click()`, then download starts authomatically.
Here's the similar "on the fly" blob creation and download code, but without HTML:

View file

@ -1,3 +1,3 @@
# Binary data, files
Working with binary data and files in Javascript.
Working with binary data and files in JavaScript.

View file

@ -1,7 +1,7 @@
# Fetch: Abort
Aborting a `fetch` is a little bit tricky. Remember, `fetch` returns a promise. And Javascript generally has no concept of "aborting" a promise. So how can we cancel a fetch?
Aborting a `fetch` is a little bit tricky. Remember, `fetch` returns a promise. And JavaScript generally has no concept of "aborting" a promise. So how can we cancel a fetch?
There's a special built-in object for such purposes: `AbortController`.

View file

@ -24,7 +24,7 @@ Because cross-origin restrictions protect the internet from evil hackers.
Seriously. Let's make a very brief historical digression.
For many years Javascript did not have any special methods to perform network requests.
For many years JavaScript did not have any special methods to perform network requests.
**A script from one site could not access the content of another site.**
@ -38,7 +38,7 @@ One way to communicate with another server was to submit a `<form>` there. Peopl
<!-- form target -->
<iframe name="iframe"></iframe>
<!-- a form could be dynamically generated and submited by Javascript -->
<!-- a form could be dynamically generated and submited by JavaScript -->
<form target="iframe" method="POST" action="http://another.com/…">
...
</form>
@ -105,7 +105,7 @@ Any other request is considered "non-simple". For instance, a request with `PUT`
So, even a very old server should be ready to accept a simple request.
Contrary to that, requests with non-standard headers or e.g. method `DELETE` can't be created this way. For a long time Javascript was unable to do such requests. So an old server may assume that such requests come from a privileged source, "because a webpage is unable to send them".
Contrary to that, requests with non-standard headers or e.g. method `DELETE` can't be created this way. For a long time JavaScript was unable to do such requests. So an old server may assume that such requests come from a privileged source, "because a webpage is unable to send them".
When we try to make a non-simple request, the browser sends a special "preflight" request that asks the server -- does it agree to accept such cross-origin requests, or not?
@ -134,7 +134,7 @@ The server can inspect the `Origin` and, if it agrees to accept such a request,
The browser plays the role of a trusted mediator here:
1. It ensures that the corrent `Origin` is sent with a cross-domain request.
2. If checks for correct `Access-Control-Allow-Origin` in the response, if it is so, then Javascript access, otherwise forbids with an error.
2. If checks for correct `Access-Control-Allow-Origin` in the response, if it is so, then JavaScript access, otherwise forbids with an error.
![](xhr-another-domain.png)
@ -149,7 +149,7 @@ Access-Control-Allow-Origin: https://javascript.info
## Response headers
For cross-origin request, by default Javascript may only access "simple response headers":
For cross-origin request, by default JavaScript may only access "simple response headers":
- `Cache-Control`
- `Content-Language`
@ -166,7 +166,7 @@ Please note: there's no `Content-Length` header in the list!
So, if we're downloading something and would like to track the percentage of progress, then an additional permission is required to access that header (see below).
```
To grant Javascript access to any other response header, the server must list it in the `Access-Control-Expose-Headers` header.
To grant JavaScript access to any other response header, the server must list it in the `Access-Control-Expose-Headers` header.
For example:
@ -283,20 +283,20 @@ The server should not forget to add `Accept-Control-Allow-Origin` to the respons
Access-Control-Allow-Origin: https://javascript.info
```
Now everything's correct. Javascript is able to read the full response.
Now everything's correct. JavaScript is able to read the full response.
## Credentials
A cross-origin request by default does not bring any credentials (cookies or HTTP authentication).
That's uncommon for HTTP-requests. Usually, a request to `http://site.com` is accompanied by all cookies from that domain. But cross-domain requests made by Javascript methods are an exception.
That's uncommon for HTTP-requests. Usually, a request to `http://site.com` is accompanied by all cookies from that domain. But cross-domain requests made by JavaScript methods are an exception.
For example, `fetch('http://another.com')` does not send any cookies, even those that belong to `another.com` domain.
Why?
That's because a request with credentials is much more powerful than an anonymous one. If allowed, it grants Javascript the full power to act and access sensitive information on behalf of a user.
That's because a request with credentials is much more powerful than an anonymous one. If allowed, it grants JavaScript the full power to act and access sensitive information on behalf of a user.
Does the server really trust pages from `Origin` that much? A request with credentials needs an additional header to pass through.
@ -348,7 +348,7 @@ So, practical difference is that simple requests are sent right away, with `Orig
- `Access-Control-Allow-Origin` to `Origin`
- `Access-Control-Allow-Credentials` to `true`
Additionally, if Javascript wants no access non-simple response headers:
Additionally, if JavaScript wants no access non-simple response headers:
- `Cache-Control`
- `Content-Language`
- `Content-Type`

View file

@ -211,7 +211,7 @@ Nowadays, `load/error/progress` handlers deprecate it.
If in the `open` method the third parameter `async` is set to `false`, the request is made synchronously.
In other words, Javascript execution pauses at `send()` and resumes when the response is received. Somewhat like `alert` or `prompt` commands.
In other words, JavaScript execution pauses at `send()` and resumes when the response is received. Somewhat like `alert` or `prompt` commands.
Here's the rewritten example, the 3rd parameter of `open` is `false`:
@ -232,7 +232,7 @@ try {
};
```
It might look good, but synchronous calls are used rarely, because they block in-page Javascript till the loading is complete. In some browsers it becomes impossible to scroll. If a synchronous call takes too much time, the browser may suggest to close the "hanging" webpage.
It might look good, but synchronous calls are used rarely, because they block in-page JavaScript till the loading is complete. In some browsers it becomes impossible to scroll. If a synchronous call takes too much time, the browser may suggest to close the "hanging" webpage.
Many advanced capabilities of `XMLHttpRequest`, like requesting from another domain or specifying a timeout, are unavailable for synchronous requests. Also, as you can see, no progress indication.

View file

@ -96,7 +96,7 @@ Sec-WebSocket-Version: 13
- `Sec-WebSocket-Version` -- WebSocket protocol version, 13 is the current one.
```smart header="WebSocket handshake can't be emulated"
We can't use `XMLHttpRequest` or `fetch` to make this kind of HTTP-request, because Javascript is not allowed to set these headers.
We can't use `XMLHttpRequest` or `fetch` to make this kind of HTTP-request, because JavaScript is not allowed to set these headers.
```
If the server agrees to switch to WebSocket, it should send code 101 response:
@ -289,7 +289,7 @@ HTML: there's a `<form>` to send messages and a `<div>` for incoming messages:
<div id="messages"></div>
```
Javascript is also simple. We open a socket, then on form submission -- `socket.send(message)`, on incoming message -- append it to `div#messages`:
JavaScript is also simple. We open a socket, then on form submission -- `socket.send(message)`, on incoming message -- append it to `div#messages`:
```js
let socket = new WebSocket("wss://javascript.info/article/websocket/chat/ws");

View file

@ -253,13 +253,13 @@ But we surely can use `samesite` together with other protection measures, like x
## httpOnly
This option has nothing to do with Javascript, but we have to mention it for completeness.
This option has nothing to do with JavaScript, but we have to mention it for completeness.
The web-server uses `Set-Cookie` header to set a cookie. And it may set the `httpOnly` option.
This option forbids any JavaScript access to the cookie. We can't see such cookie or manipulate it using `document.cookie`.
That's used as a precaution measure, to protect from certain attacks when a hacker injects his own Javascript code into a page and waits for a user to visit that page. That shouldn't be possible at all, a hacker should not be able to inject their code into our site, but there may be bugs that let hackers do it.
That's used as a precaution measure, to protect from certain attacks when a hacker injects his own JavaScript code into a page and waits for a user to visit that page. That shouldn't be possible at all, a hacker should not be able to inject their code into our site, but there may be bugs that let hackers do it.
Normally, if such thing happens, and a user visits a web-page with hacker's code, then that code executes and gains access to `document.cookie` with user cookies containing authentication information. That's bad.

View file

@ -255,7 +255,7 @@ There exist following character classes:
...But that's not all!
Modern Javascript also allows to look for characters by their Unicode properties, for instance:
Modern JavaScript also allows to look for characters by their Unicode properties, for instance:
- A cyrillic letter is: `pattern:\p{Script=Cyrillic}` or `pattern:\p{sc=Cyrillic}`.
- A dash (be it a small hyphen `-` or a long dash `—`): `pattern:\p{Dash_Punctuation}` or `pattern:\p{pd}`.

View file

@ -2,7 +2,7 @@ We need to find the beginning of the comment `match:<!--`, then everything till
The first idea could be `pattern:<!--.*?-->` -- the lazy quantifier makes the dot stop right before `match:-->`.
But a dot in Javascript means "any symbol except the newline". So multiline comments won't be found.
But a dot in JavaScript means "any symbol except the newline". So multiline comments won't be found.
We can use `pattern:[\s\S]` instead of the dot to match "anything":

View file

@ -8,7 +8,7 @@ The typical situation -- a regular expression works fine sometimes, but for cert
In a web-browser it kills the page. Not a good thing for sure.
For server-side Javascript it may become a vulnerability, and it uses regular expressions to process user data. Bad input will make the process hang, causing denial of service. The author personally saw and reported such vulnerabilities even for very well-known and widely used programs.
For server-side JavaScript it may become a vulnerability, and it uses regular expressions to process user data. Bad input will make the process hang, causing denial of service. The author personally saw and reported such vulnerabilities even for very well-known and widely used programs.
So the problem is definitely worth to deal with.

View file

@ -1,7 +1,7 @@
# Unicode character properies \p
[Unicode](https://en.wikipedia.org/wiki/Unicode), the encoding format used by Javascript strings, has a lot of properties for different characters (or, technically, code points). They describe which "categories" character belongs to, and a variety of technical details.
[Unicode](https://en.wikipedia.org/wiki/Unicode), the encoding format used by JavaScript strings, has a lot of properties for different characters (or, technically, code points). They describe which "categories" character belongs to, and a variety of technical details.
In regular expressions these can be set by `\p{…}`. And there must be flag `'u'`.

View file

@ -5,7 +5,7 @@ To grasp the use case of `y` flag, and see how great it is, let's explore a prac
One of common tasks for regexps is "parsing": when we get a text and analyze it for logical components, build a structure.
For instance, there are HTML parsers for browser pages, that turn text into a structured document. There are parsers for programming languages, like Javascript, etc.
For instance, there are HTML parsers for browser pages, that turn text into a structured document. There are parsers for programming languages, like JavaScript, etc.
Writing parsers is a special area, with its own tools and algorithms, so we don't go deep in there, but there's a very common question: "What is the text at the given position?".
@ -15,7 +15,7 @@ For instance, for a programming language variants can be like:
- Or an operator `pattern:[+-/*]`?
- (a syntax error if it's not anything in the expected list)
In Javascript, to perform a search starting from a given position, we can use `regexp.exec` with `regexp.lastIndex` property, but that's not what we need!
In JavaScript, to perform a search starting from a given position, we can use `regexp.exec` with `regexp.lastIndex` property, but that's not what we need!
We'd like to check the match exactly at given position, not "starting" from it.