JavaScript has a TypedArray class, it's just hidden.

[ryanc@infosec.exchange]

JavaScript has a TypedArray class, it's just hidden.

To access it, one simply needs to do:

const TypedArray = Object.getPrototypeOf(Int8Array.prototype).constructor

You can then use it with the instanceof operator.

[ryanc@infosec.exchange]

See also:

const AsyncFunction = (async _=>_).constructor;
const GeneratorFunction = (function *_(){}).constructor;
const AsyncGeneratorFunction = (async function *_(){}).constructor;

[ryanc@infosec.exchange]

What other standard JavaScript classes are hidden like this without a global reference?

[ryanc@infosec.exchange]

Some of these are actual working constructors, e.g. you can do:

let g_ = new GeneratorFunction('let i = 0; while (1) yield i++;')();
g_.next(); // yields {value: 0, done: false}
g_.next(); // yields {value: 1, done: false}
g_.next(); // yields {value: 2, done: false}

[ryanc@infosec.exchange]

This is, of course, "sparkling eval". Content-Security-Policy probably treats it as such, otherwise I just accidentally dropped 0-day.

[ryanc@infosec.exchange]

My partner's mother bought me a club mate for Christmas, and between the caffeine rush and how much the commercials playing during the football() game that's on the TV are making me despise capitalism, I'm shitposting to cope.

[cyclophora@mastodon.social]

@ryanc wait why does it take a string

[ryanc@infosec.exchange]

@cyclophora LOL.

Seriously though, it's just like the regular Function() constructor, except for generator functions.

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/Function

Literally eval with extra steps.

[cyclophora@mastodon.social]

@ryanc what is the point of this why does it not take another function or something. I'm crying blood please help

[cyclophora@mastodon.social]

@ryanc was it added before people realized eval was a bad idea?

[f4grx@chaos.social]

@ryanc programming language of the utterly deranged, look at what they are asking your respect for all this time.

[ryanc@infosec.exchange]

@f4grx Some might consider this knowledge unnatural but knowing it pays well enough to be worth the psychic damage.

[ryanc@infosec.exchange]

@cyclophora The Function() constructor? That's been around for ages. Folks knew better by the time generator functions were a thing, but violence was chosen.

There are so many ways to do eval in JavaScript, though.

[cyclophora@mastodon.social]

@ryanc i feel like there should be a way to turn off eval from inside JS in addition to CSP

[ryanc@infosec.exchange]

@cyclophora Did you know that settimeout can take a string argument?

You can add an invisible button to the dom with an onclick attribute that's a string of code and then call .click() on it.

Create an iframe with a javascript:... URI.

It's a bit of a lost cause.

Also, I've written bytecode interpreters in JavaScript that can run arbitrary code and bypass CSP restrictions.

[ge0rg@chaos.social]

@ryanc
Not sure if sarcasm or actual Javascript usability improvement... or both?!

[ryanc@infosec.exchange]

@ge0rg Mostly sarcasm. There are more sensible ways to detect whether something is a typed array.