I just read this: .aspx

I was under the impression that overwriting Object or Array only had an effect if you chose to use the constructor functions when creating arrays/objects, but, according to that article, it also has an effect on literal creation ({} and [])...

My logic:

Array = function(){ alert('Hi'); };

[1,2,3,4,5];
([1,2,3,4,5]);
var a = [1,2,3,4,5];

// ...
// ... Nothing is alerted

So, am I going crazy or are there some implementation-specific quirks I'm not aware of?

I just read this: http://haacked./archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx

I was under the impression that overwriting Object or Array only had an effect if you chose to use the constructor functions when creating arrays/objects, but, according to that article, it also has an effect on literal creation ({} and [])...

My logic:

Array = function(){ alert('Hi'); };

[1,2,3,4,5];
([1,2,3,4,5]);
var a = [1,2,3,4,5];

// ...
// ... Nothing is alerted

So, am I going crazy or are there some implementation-specific quirks I'm not aware of?

• javascript
• security
• arrays
• xss

3 Answers 3

As far as I know this is an issue with the ECMAScript specification and was fixed in all major browsers over a year ago. Here is a link that links you to the most relevant links ;)

But to actually answer your question, yes, the Object and Array constructors are also invoked for literal creations. The fix browsers implemented just made these (and others) constant so they can't be overridden by custom scripts.

The EcmaScript 5 draft standardizes this fix Josef mentions. It specifies the behavior of the array constructor in terms of the value of the Array global at the time the context was created as described in section 11.1.4.

Semantics

The production ArrayLiteral : [ Elisionopt ] is evaluated as follows:

1. Let array be the result of creating a new object as if by the expression new Array() where Array is the standard built-in constructor with that name.

Instead of the old ES 262 behavior which allowed for replacing the Array constructor:

Semantics

The production ArrayLiteral : [ Elisionopt ] is evaluated as follows:

1. Create a new array as if by the expression new Array().

That said, do not rely on [] working sensibly on older interpreters.

By setting Array to be a function you are not overriding the constructor of arrays, but instead replacing the function.

To correctly override the constructor you would use the Array.prototype.defineSetter to set the method being called on construction, and this would be called both on new Array() and when using the literal notation.