I found yet another way to invoke JavaScript functions…
1 reactions
I found yet another way to invoke JavaScript functions without parentheses
It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.
Other seven methods are documented in the portswiggers research article: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses
#technology #dev #programming #js
It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.
Other seven methods are documented in the portswiggers research article: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses
#technology #dev #programming #js
1
| 7,000 mlx | |
| 8 | |
| 1 |
comments
Really interesting JavaScript research! The different ways of invoking functions without parentheses show how deep the language’s quirks can go. Great technical exploration. 👏
