paulw54jrn
2015-10-01 19:47:27 +08:00
评论褒贬不一啊
```
You're using JS, which helps the expressivity issue a bit, but in exchange it's inheriting all the problems of JS, and squishing them into my web server, and with no apparent framework for making common and dangerous tasks simple and safe.
For example, the comment in your second says that unary + applied to a string will "convert upstream number to integer", but that's not true. It converts a String to a Number (including the "number" NaN). +"0.5" is the Number 0.5, which will send you to the server "my_upstream0.5". +"X" is NaN, which will send you to "my_upstreamNaN". Unary + supports scientific notation, too, so "1.2e-100" becomes "my_upstream1.2e-100". It supports hexadecimal integers, too, though that's less interesting when you clamp to [0,1].
These mis-routings are probably harmless in this case, but it's not hard to imagine similar situations where they're not.
If the authors of a feature can't use it safely in their trivial demo examples in the product announcement, what confidence do I have that I'm going to be able to make it work reliably and securely on an actual production website?
--JS Dude
```