Question

I have read many question here in the site but didnt got to understand the problem with the parenthesis thing.

eval( '{a:alert(1)}'); //alert 1

but also this alert 1 :

eval( '('+'{a:alert(1)}'+')'); //alert 1

So how does '()' helps me ?

I already know that () makes the code to be read as epxression and not as a statement

but I dont see in my sample how it is gonna help.

Can you please provide a sample ?

Answer 1

Consider:

eval("({a: 'my great object'}.a);");

and

eval("{a: 'my great object'}.a;");

As already mentioned: the second one is a block of code with label so .a simply doesn’t have any sense.