---
# System prepended metadata
title: javascript???
tags: [cheatsheet]
---
---
title: 'javascript???'
tags: cheatsheet
---
:::spoiler TOC
[TOC]
:::
Javascript
===
## spec & impl
- 導讀
- [how to validate javascriptknowledge by Huli](https://blog.huli.tw/2022/01/30/how-to-validate-javascript-knowledge/)
- spec
- [ECMAScript](https://262.ecma-international.org/14.0/)
- [Web Application APIs](https://wicg.github.io/controls-list/html-output/multipage/webappapis.html#webappapis)
> multipage 和 one-page 內容有出入
- 實作
- javascript engine: https://github.com/v8/v8/tree/master/src
- javascript 語法解析: https://github.com/v8/v8/blob/master/src/parsing/scanner-inl.h
## Inspect
- Node.js prototype access
- from [@maple3142](https://blog.maple3142.net/2023/09/17/seccon-ctf-2023-quals-writeups/#node-ppjail)
- need to patch [v8 source code](https://github.com/v8/v8/blob/3f12c06ea0fadfd4a962fe6fd84693f01751a4f3/src/objects/js-objects.cc#L5264-L5274)
```
let props = ''
Object.prototype.__proto__ = new Proxy(
{ __proto__: null },
{
get: (target, prop, receiver) => {
props += `GET ${prop}` + '\n'
return Reflect.get(target, prop, receiver)
},
__proto__: null
}
)
```
- for Deno
```
const proxy = new Proxy(
{},
{
get: (target, prop, receiver) => {
console.log('get', prop)
return Reflect.get(target, prop, receiver)
}
}
)
Object.setPrototypeOf(Function.prototype, proxy)
Object.setPrototypeOf(Array.prototype, proxy)
Object.setPrototypeOf(Error.prototype, proxy)
Object.setPrototypeOf(String.prototype, proxy)
Object.setPrototypeOf(Number.prototype, proxy)
```
## syntax
- Auto Semicolon Insertion (ASI)
- https://slides.com/evanyou/semicolons#/18/0/0
- https://cjihrig.com/automatic_semicolon_insertion
- `+-[(/` + restricted production
- 可以用來繞過一些黑名單
- [label](https://developer.mozilla.org/zh-TW/docs/Web/JavaScript/Reference/Statements/label)
- ployglot 一些協議開頭`cid:a=123`
```
a: //label
a=123
http:console.log(7122)
```
- [delete](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/delete)
- limit space: `delete[this][0][attr] // euqal 'delete window.attr', [this] === [window]`
### [Comments](https://262.ecma-international.org/14.0/#sec-comments)
- in ECMAScript spec
- `//`
- `/*`
- extended in v8
- ``
- shebang
- only work for first line`#! aaaaa`
### [Line Terminators](https://262.ecma-international.org/14.0/#sec-line-terminators)
- \u000a,\u000d,\u2028,\u2029
- `eval("alert\u2029(1)")`
## Comparison
- [The Abstract Equality Comparison Algorithm](https://262.ecma-international.org/5.1/#sec-11.9.3)
```
console.log(NaN != NaN)
console.log(undefined == undefined)
console.log(null == null)
console.log(typeof NaN == 'number')
console.log(typeof null == 'object')
console.log(+0 == -0)
console.log(null == undefined)
// Return true if x and y refer to the same object. Otherwise, return false.
var a = {}, b = {}
console.log(a != b)
console.log((()=>{}) != (()=>{}))
console.log(14 == '0xe') // 14 == Number('0xe')
```
- [SameValueZero](https://tc39.es/ecma262/multipage/abstract-operations.html#sec-samevaluezero)
- if is number, use [`Number::sameValueZero`](https://tc39.es/ecma262/multipage/ecmascript-data-types-and-values.html#sec-numeric-types-number-sameValueZero)
- [`Array.prototype.includes`](https://tc39.es/ecma262/multipage/indexed-collections.html#sec-array.prototype.includes)
- `[NaN].includes(NaN) // true`
- [`IsStrictlyEqual`](https://tc39.es/ecma262/multipage/abstract-operations.html#sec-isstrictlyequal)
1. If Type(x) is not Type(y), return false.
2. If x is a Number, then
a. Return [Number::equal(x, y)](https://tc39.es/ecma262/multipage/ecmascript-data-types-and-values.html#sec-numeric-types-number-equal).
3. Return SameValueNonNumber(x, y).
- [Number::equal(x, y)](https://tc39.es/ecma262/multipage/ecmascript-data-types-and-values.html#sec-numeric-types-number-equal)
- NaN != NaN
- +0 == -0
- [Number::sameValue](https://tc39.es/ecma262/multipage/ecmascript-data-types-and-values.html#sec-numeric-types-number-sameValue)
- NaN == NaN
- +0 != -0
## Regex
- regex global matching [lastIndex](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/lastIndex)，flag `g`(global) and `y`(sticky) is [stateful](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/test)
```
const r = /cjiso/g
r.exec('cjiso')
console.log(r.lastIndex) // 5
r.exec('cjiso') == null //true
```
- [dot match behavior](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/dotAll) flag `s`
```
/{.*}/.test("{evil\u2026}") // false
/{.*}/s.test("{evil\n}") // true
```
> default `.` won't match below
> U+000A LINE FEED (LF) ("\n")
> U+000D CARRIAGE RETURN (CR) ("\r")
> U+2028 LINE SEPARATOR
> U+2029 PARAGRAPH SEPARATOR
- [Get the last matched string](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/input) `RegExp.$_`, `RegExp.input`
```
/Flag/.test('Flag{a}')
console.log(RegExp.input) // FLAG{a}
```
- [Get the last matched part](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/lastMatch) `RegExp['$&']`, `RegExp.lastMatch`
```
var flag = 'Flag{aaa}'
flag = flag.replace(/{.*}/,'$&') // FLAG{aaa}
```
- [Get the last parenthesized part](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/lastParen) `RegExp['$+']`,`RegExp.lastParen`
```
/(Flag){(a.)+}/.test('Flag{abacad}')
console.log(RegExp['$+']) // ad
```
- [Get left, right context of matched](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp/rightContext) ```RegExp.['$`']``` (left) ```RegExp.["$'"]```(right)
```
var tmpl = '![]()
'
tmpl.replace('{value}',"$'