Yet another way to invoke functions without parentheses

This reminds me of "Creators admit Unix, C hoax" (e.g. https://www.gnu.org/fun/jokes/unix-hoax.html)

> We stopped when we got a clean compile on the following syntax:

    for(;P("\n"),R--;P("|"))for(e=C;e--;P("_"+(*u++/8)%2))P("| "+(*u/4)%2);

I love this. This is a fun hack, but the article also hearkens back to pre-LLM days when people were still interested in _code_.

I want to put the called function after the arguments:

    (((x)f)g)h

    f(g(h(x)))

I want to write a super pedantic book showing every way I can think of to move data from here, to there. In the same program, or between programs.

Global variable.

Parameter to a function.

Pass a functor/lambda, get the value.

Environment variable.

Registry.

File.

Store it in a ping response.

VRAM texture that you write and then read.

Database.

REST server.

I'm pretty sure I could come up with a thousand ways.

But... why? Why do I want to write this book? Why has it been on my mind?

Off topic: This website looks like a ransom note

Not gonna work on Firefox, since according to the doc, Error.prepareStackTrace is an optional API and only implemented by V8.

  Object.prototype.message='alert\x281337\x29';Array.prototype.toString=Error.prototype.toString;Error.prepareStackTrace = Function;const x = new Error;x.valueOf=x.stack;+x;

JavaScript is so cursed.

This is a creative hack, and here’s where it actually matters. Blocklist-based sanitizers and WAFs typically work by matching a string or a regex, so this type of hack usually slips past them. I found this class of XSS in audits in telemetry fields that were protected by a regex blocklist. The actual fix was not just a longer blocklist, but context-aware output encoding (plus a CSP as defense in depth).

It is called ... Ruby.

(Though, parentheses are sometimes needed due to ambiguity. But by and large, the lispy legacy has been overcome already.)

What's the purpose of the +x at the end?

[flagged]