3 ms·
that weird behavior of javascript can actually be used for xss attacks, by being able to assemble strings. for example: (![]+[])[+!+[]] produces an "a".
by there 15y ago
that weird behavior of javascript can actually be used for xss attacks, by being able to assemble strings. for example:
(![]+[])[+!+[]]
produces an "a".
https://news.ycombinator.com/item?id=1153383 https://news.ycombinator.com/item?id=1153383
- jrockway 15y agoBut of course, anyone that actually wants to protect against XSS attacks won't allow user input to be evaluated. If they did want to allow user-supplied Javascript, they wouldn't blacklist, they would whitelist (by parsing the user-supplied script and using the AST to emit only whitelisted operations).