Hacker News Reader

Not sure that []["filter"] is all that funky of an example as it's just grabbing the arrays prototype method "filter" using bracket notation.

Here's some better examples of JS oddities: http://stackoverflow.com/q/9032856/1538708

View on HN

The funkiness is really that []["filter"]["constructor"] is a function that behaves like eval(), or rather, it returns a function that when called executes the string that was passed to the constructor function. That's how they're actually running the code.

> []["filter"]["constructor"]("alert(1)")()

Reply on news.ycombinator.com