4 ms·
The minimum set of `+!()[]` chars are proven to be TC [0] So good luck trying to define a non-TC js-subset that allows to use these chars. [0] http://jsfuck.c
by _lce0 10y ago
The minimum set of `+!()[]` chars are proven to be TC [0]
So good luck trying to define a non-TC js-subset that allows to use these chars.
[0] http://jsfuck.com/ http://jsfuck.com/
- DougBTX 10y agoThe mitigation for this is: [ ] subscript operator except when the subscript is a numeric literal or string literal or an expression that must produce a number value. So expressions like a[i] are disallowed because we cannot statically determine that i is not one of the dangerous property names. But a[+i] is allowed, because +i will always produce a number.
- deleted 10y ago[deleted]