JS Security Tip 05-01-2024 ICYMI

Javascript sometimes has its fair share of quirky behavior. I'll keep this one brief and to the point.

(0)['constructor']['constructor']('return someFunction') is a way to turn the string argument 'return someFunction' into an actual function that will run; i.e., most likely someone else's script. The expression can be immediately invoked with arguments. For example:

(0)['constructor']['constructor']('return alert')()('hi') is equivalent to alert('hi') which will show the popup with message "hi".

But that's not really the scary part. The scary part is that the …

alert argument can fair function javascript point return run script security share tip turn webdev