Question

I have been toying around with obfuscating Javascript with just brackets and other symbols, as per this question and this automatic generator – for purely educational reasons, may I say 🙂

For example, evaluating (![]+[])[+!+[]] gives me the letter "a".

However, it seems that the examples rely on [].sort.call() returning the window object. My problem is that whenever this doesn’t seem to work on any of the browsers I have installed (Chrome 14, FF 9, IE 9):

//They told me this would return the window object
[].sort.call() 

//But I get an exception instead:
"TypeError: Array.prototype.sort called on null or undefined"

So I ask:

• Was [].sort.call() fixed on recent browsers or does it still return the window object and its just me doing something wrong?
• If it is the case that I can’t use this approach anymore, are there any other ways I can access the window object using only brackets, parenthesis, exclamation marks and the + operators?

Answer 1

This was changed with ECMAScript 5. From 15.3.4.4:

NOTE The thisArg value is passed without modification as the this value. This is a change from Edition 3, where a undefined or null thisArg is replaced with the global object and ToObject is applied to all other values and that result is passed as the this value.

…and sort() calls ToObject on that this value, throwing the TypeError exception.

And, given the addition of strict mode, which further reduces access to the global object, your options are probably few. Though, without "use strict", you might try using this.