Feature request: deep freeze object

[hilja]

Object.freeze(obj) is very handy but it only operates on the object’s immediate properties.

The result of calling Object.freeze(object) only applies to the immediate properties of object itself and will prevent future property addition, removal or value re-assignment operations only on object. If the value of those properties are objects themselves, those objects are not frozen and may be the target of property addition, removal or value re-assignment operations.

From MDN

The MDN article provides an example method:

function deepFreeze(object) {
  // Retrieve the property names defined on object
  const propNames = Reflect.ownKeys(object);

  // Freeze properties before freezing self
  for (const name of propNames) {
    const value = object[name];

    if ((value && typeof value === "object") || typeof value === "function") {
      deepFreeze(value);
    }
  }

  return Object.freeze(object);
}

Why might freezing be important?

You could freeze sensitive objects like pricingObject or checkoutConfig etc. to prevent tampering by browser extensions or crafty users. It can't really protects against that, but it might be beneficial for the developer to freeze objects not meant to be changed.

[aleclarson]

Using Object.freeze (even deeply) doesn't meaningfully protect against malicious users or extensions (client-side code can always be modified or replaced). At best, this helps guard against accidental mutation within our own code.

Happy to consider deepFreeze, but we should align on its intended purpose. If it's for immutability guarantees or dev-time correctness, that makes sense; if it's meant as a security measure, that's not something it can reliably provide.

[hilja]

but we should align on its intended purpose ... if it's meant as a security measure, that's not something it can reliably provide.

That’s absolutely true. I've looked into it more deeply, extensions run before the page, so they have full control, they can always clone objects and override MutationObservers. At its best it’s a very elementary defense-in-depth measure. Basically a runtime as const.