JavaScript for hackers

I don't get it. His first example is that since the string replace method takes a callback as its second argument, you can use it to run code. So if you happen to find an app that injects unescaped user input into Javascript, you could enter the string alert(1)".replace(/.+/,eval)// and have it run the alert.

But if the app is injecting unescaped user input into code, wouldn't a simple ";alert(1);// achieve the same thing? Why do you need to be tricky?

The examples seem to be based on the premise that web apps commonly forgo the simple escaping of quotes, and instead implement a complex parsing and analysis of user input as code to identify malicious statements, which can be defeated as long as you obfuscate enough.

Here's something I didn't know - you can use unicode escapes outside of strings. Code like `\u0061\u006c\u0065\u0072\u0074(1)` translates to `alert(1)` and runs just fine.

>JavaScript doesn't know the result of a function until it is executed, and obviously it has to call the function to return the variable type.

> +alert(1)--

That's a particularly poor example. There's no reason to expect `alert` to run there (in current Chrome, it doesn't) - a function can't return an l-value, so you don't have to wait for the return value to determine that it'll be invalid.

Also, I'm not sure what the unary + is supposed to achieve - it has the same precedence as post-decrement, with right to left associativity, so knowing that the post-increment will fail shows us that the + will never run.

This article is dated 2009. Are these still security holes in Opera?

This article is written by Gareth Heyes. He has a blog about JavaScript weirdness and hacking:

http://www.thespanner.co.uk/