5 ms·

Because it is possible to get around with just code: http://escape.alf.nu/20 http://escape.alf.nu/20 (which I have done, under another username)

• gibybo 13y ago
  So how do you get around it? Or, I suppose more importantly, what else do you have to do to prevent people from getting around it?
  • girvo 13y ago
    It seems he's routing calls to print the code into console.log and eval-ing that string, which is quite interesting.
    • gibybo 13y ago
      Eh? Who is "he"? What do you mean routing calls?
      • ewoodrich 13y ago
        In the snippet posted by tshadwell. The code outputs a string into the console via console.log(), then executes the snippet from the console via eval(). Presumably to avoid to avoid Facebook's protections against console copy\paste execution. Edit: I'm wrong. Need some sleep.
        • gibybo 13y ago
          tshadwell did not post a code snippet he wrote. He posted a link to a site that demonstrates the sandbox that Facebook uses (I believe the Facebook engineer that wrote the Facebook implementation also owns escape.alf.nu). This code does not break out of the sandbox, it creates it.
          • ewoodrich 13y ago
            I never claimed tshadwell wrote it, but you are correct, my skimming of the code was incorrect. It redirects the evaluated output of an escaped version of a string to the console.