Overwriting the Array constructor does not affect [], right?


Overwriting the Array constructor does not affect [], right?



I just read this: http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx

I was under the impression that overwriting Object or Array only had an effect if you chose to use the constructor functions when creating arrays/objects, but, according to that article, it also has an effect on literal creation ({} and [])...

My logic:

Array = function(){ alert('Hi'); };  [1,2,3,4,5]; ([1,2,3,4,5]); var a = [1,2,3,4,5];  // ... // ... Nothing is alerted 

So, am I going crazy or are there some implementation-specific quirks I'm not aware of?




Upload a virus using a webform

1:



UnknownHostException for server java
As far as I know this is an issue with the ECMAScript specification and was fixed in all major browsers over a year ago.


Cause for ASP.NET Security Exception
Here is a link that links you to the most relevant links ;).
How to put double quotes in ADO.NET query?
But to actually answer your question, yes, the Object and Array constructors are also invoked for literal creations.


Help with 2-part question on ASP.NET MVC and Custom Security Design
The fix browsers implemented just made these (and others) constant so they can't be overridden by custom scripts..
Is ASP.NET Membership suitable for a shopping cart?


Secure File Upload in Ruby On Rails


Least privileges required to install a Windows Service remotely

2:


The EcmaScript 5 draft standardizes this fix Josef mentions.

It specifies the behavior of the array constructor in terms of the value of the Array global at the time the context was created as described in section 11.1.4..
Semantics . The production ArrayLiteral : [ Elisionopt ] is evaluated as follows: .
  1. Let array be the result of creating a new object as if by the expression new Array() where Array is the standard built-in constructor with that name.

Instead of the old ES 262 behavior which allowed for replacing the Array constructor:.
Semantics . The production ArrayLiteral : [ Elisionopt ] is evaluated as follows: .
  1. Create a new array as if by the expression new Array().
That said, do not rely on [] working sensibly on older interpreters..


3:


By setting Array to be a function you are not overriding the constructor of arrays, but instead replacing the function.

. To correctly override the constructor you would use the Array.prototype.defineSetter to set the method being called on construction, and this would be called both on new Array() and when using the literal notation.

.



92 out of 100 based on 72 user ratings 722 reviews