Question

I would like to know why the follow code doesn’t work in the Google Chrome:

// creates a xss console log

var cl = ( typeof( console ) != 'undefined' ) ? console.log : alert;
cl('teste');

output: Uncaught TypeError: Illegal invocation

thanks.

Answer 1

When you write cl();, you’re calling log in the global context.

Chrome’s console.log doesn’t want to be called on the window object.

Instead, you can write

cl = function() { return console.log.apply(console, arguments); };

This will call log in the context of console.