How does JSF* actually eval what it constructs?

That's the one part I don't understand

if you look at the transpiler page it explains what translates to eval

@BusinessCat 1. Construct individual letters with e.g. ([]+![])[+[]] ("false"[0], or "f"). 2. Build up a string such as fill or filter, then do e.g. []["filter"]. 3. Build up the string constructor so you are now doing []["filter"]["constructor"]. This returns the Function function. 4. Use Function to create a function out of a string and evaluate it.

Oh... [] is a sort of global array?

Not global...

[] is just an ordinary array object, []["filter"] is its .filter function.

Oh yeah, I forgot you can do that in JS

[] is essentially list()

yeah, it's the same as new Array() in JS

I forgot you could refer to its name as a key and not just use .

Yep

So you can just take any arbitrary function of a class, and take the function constructor from it

Fun fact: Given any arbitrary JS program, it's possible to blacklist any single ASCII character and still write the same program without that char.

@ETHproductions that's true of a lot of languages

But I didn't think JS was one of those languages until this morning

Obviously JSF*** rules out all chars but ()[]+!. You can rule out ! because you could also use < or = or >

I believe binary + can be completely eliminated by using - - for addition, and combinations of String() and .concat() for concatenation

Unary + also works as - -, postfix ++ can be rearranged to be prefix, prefix ++ can be changed to -=-1

How can you replace () though?

I was going to say "how do you form String() without concatenation", then I realised you had all of the rest of ASCII

@ais523 Yeah, you can't just eliminate all chars but []() and still create any valid program :P

(…) as grouping marks can be changed to […][0]; for functions, maybe `…` in ES6?

If I have a webpage with JS embedded into it, what happens if I use the JS to modify itself?

@Pavel it changes, but not retroactively

@ais523 Right, or (…,…,…) to […,…,…][2]

But calling functions with backticks is the tricky part

if you can replace with [...][0] for functions you can just eval it then ...

so can we cut down JSFlike this, using some indirect means for function calls?

what are () used for at the moment? […][+[]] will substitute for its grouping purpose, using only the JSF characters

If you call a function e.g. myFunc`abc${123}xyz` , it will actually call it as myFunc(["abc","xyz"],123), making calling function with arbitrary arguments pretty much impossible

stupid backticks

you don't really need arbitrary arguments, you just need enough to get at eval

@ais523 Hmm... I hadn't thought of that

I was kind of trying to get a JSF-like thing without parens

What I was thinking of was if you do Function`a${"return myCode"}b` , it will create a function with parameters a and b and a body of return myCode

But that requires we use ${} as well

"Onward trusty Capra, we must not be late for the dinner party!"

So the minimal charset without parens is []+!`${}

I'm guessing we can't drop the ! here either?

I don't believe so, but you never know...

If you change the ! to a = (so as to use == to create booleans), it also allows you to do assignments to $, $$, etc.

Gosh darn JS

I'm not sure what the minimal charset without brackets is. Since all property names would have to be typed out, it's got to be pretty high

I've just been checking in the console, you can built a lot of strings without parens

the only issue is just evalling them

Yeah

`` will run a function with no arguments

so you can certainly construct a function, you just can't give it a non-constant body

@ais523 Try console.log``

But for the most part, functions called like this do act like they're given no arguments

right

It should be given an empty string, not nothing, IIRC

the problem is that Function, the function constructor, wants the body of the function as an argument

ah right, empty string

Array containing an empty string, actually

Another thing I considered was using => to create literals rather than [], but the problem with that is that now we have no valid expressions because ()=>() doesn't work

This is a bit more than nothing at this point

And the array of the empty string has a .raw property that contains an array of the raw version of the empty string (which is just the empty string)

But JS doesn't ever do anything with that unless .raw is called explicitly on the array

So we've actually got {"", raw=[""]}

Pretty much

I wonder if we can do something with that

I don't think there are any more layers, but I may be wrong...

String.raw is the only built-in I know of that uses the .raw property

String.raw`Hello\nworld!\\` == "Hello\\nworld!\\\\"

Maybe we should move to another room if we're going to keep talking about this...

good idea, probably the esolangs room?

I guess that works

Want me to move something for you?

yep, all this JSF talk

← 72 messages moved from The Nineteenth Byte

OK, so thinking about things, we don't necessarily have to do an eval at all

We should totally make an efficient JSF transpiler

we can create pretty much any string out of []+!; and ` is thus enough to call any function after that, but only with the null string as arguments

alternatively, we can use =, <, or > instead of !

now, if we have =, we can set properties

so, a) can we set a property of a function in order to change its source code?

b) can we modify the DOM to add a new <script> tag or something like that?

(I assume the latter counts)

@ais523 Problem: we can only get +-.()[]{}0123456789INacdefinotuvy

that's without !, =, <, >

with = you can get the letters of false

Oh... I'm dumb :P

and the l is enough to get to almost anywhere else from there

Never mind then, I'll make a new alphabet

can we access the DOM without calling functions?

Not without a reference to some DOM element

Can we get

body

like, if we get anything in the DOM, we can traverse it to get anything else

I think our full alphabet is ()+-.0123456789IN[]acdefilnorstuvy{} plus space and newline

Lemme see what functions we can access with that

you can get capital A off []["constructor"]

Oh right, and B and S

I don't think Body works

and b off (1)["constructor"]

So that's ()+-.0123456789ABFINS[]abcdefgilmnorstuvy{}

there's a b in Number

Then we can get body, and that's a DOM.

but I'm not sure we can do much with the string body

We can't get globals, can we...

We can get the entire lowercase alphabet with (number)["toString"](othernumber)

no we can't, no parentheses

Ah, darn

Backticks are allowed though, right?

Uncaught RangeError: toString() radix argument must be between 2 and 36

What's your code?

(1)["toString"]``

Huh

that makes sense, we're giving toString a null string as the radix argument

It works if you put a number between the backticks, but of course that's not allowed

Anyway, back to which functions we can access...

assuming we can access any function (which seems plausible), do any of them let us escape the pure-ES6 fragment of JS?

and get into the DOM or other libraries?

you might be able to do it on IE

I seem to remember that older IE had a .window property on pretty much anything

this appears to be a Window if no objects are involved

is there any way to get at this?

Hmm...

Perhaps some function property will let us do something similar

We can get </>w", through various other methods, but I don't know if any of those would be useful

well it looks like you could write some pretty decent HTML with that, if only you had somewhere to put it

gtg, I'll come back in a little while if I can

n["toString"]`36` can be used to get every lowercase letter effectively.

now you're using a whole two extra characters :-P

I'm seeing if I can construct that 36 using templates.

Although (25)["toString"](`${!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![‌​]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]‌​+!![]+!![]+!![]+!![]+!![]+!![]+!![]+!![]}`) works, without parentheses does not.

[25][0]["toString"]

oh right, there's another set of parens

Back for a few minutes

If only we could call functions with brackets somehow...

can we get at any variables that will keep their values?

Array, String, Function, etc.

[]["constructor"]["a"] should be a decent one

But we don't really have a way to assign

[[]["constructor"]["prototype"]["a"]="b"] + []["constructor"]["prototype"]["a"]

returns bb

But aren't we only using []+!` ?

this is assuming we use = rather than !

Oh, good idea

I was so excited I posted it to the wrong channel :-(

Never mind then, we have a fine variable system

the reason this is important is that it lets us store a function in a variable, and then call that function multiple times

giving us loops and recursion

I think this is enough for Turing-completeness, even if it can't actually do anything

Ah...

Can we do anything by putting properties on the Function prototype?

I don't think that does anything, apart from letting us store the values

Hmm, yeah

But I'm not sure how recursion would be implemented (or loops, for that matter)

you implement loops using recursion

and to do recursion, what you do is you create a function with a long string inside the ```

that contains the function body

then get it to call itself at the end

via extracting it back out of a property

you can even do an if statement via making the property an array, and indexing into it (this is an INTERCAL trick)

gah, it doesn't quite work, you can't nest uses of ``

so you can't do any further calls from the inside function

a = [10,Function`[a[a[0]]=a[0],a[0]=a[0]-1,a[1]()]`]; a[1]``

that's my proof of concept

but unfortunately there are those awful parentheses in the inside definition

it does work apart from that, though

if you try running it, you'll see that after it crashes with an error, a will be set to [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10], which is pretty good evidence that there's a working loop there

That's really cool

I hope we can do more with that

it's also not quite TC unless you assume that doubles are unbounded (they aren't)

or, wait, no, it is

you can do an arbitrary-size counter by nesting lists

like, 0 is [], 1 is [[]], 2 is [[[]]], and so on

How did we get Function anyway..?

you find an arbitrary function (via constructing any method name), then take its constructor

constructor is in our character set

hmm, can we somehow get a function to run as a side effect of an assignment?

looks like that needs a function call, unfortunately

We can call functions with func``

In Firefox I've managed to get all of "()+,-./0123456789<>ABFINOS[]abcdefgijlmnorstuvwy{}, plus space and newline

In strings, that is

Cool, what is this? ES6Fuck?

right; the problem is, we haven't currently found a way to define a function that's capable of calling functions

and we also haven't found a way to define a function whose source code is anything other than a string literal

O was the hardest so far. The simplest way to get Object that I've found is []["entries"]``["constructor"]

I can't believe we don't have p

We can use Function`some_code```, can't we?

you can't create an infinite loop like that

@ATaco Right, but that code has to be entirely made of []+=

so it doesn't get you any benefit AFAICT

Unless we put it in ${}, for some part.

@ATaco But that would require adding chars to our 5-char charset

What's our 5 char set?

We're trying to get a TC subset of JavaScript in under 6 chars

[]`+=

[]+=`

Well then.

it's so close, we have a method that would work if ` nested but they don't

If we could change the getter or an object, we could make it automatically call a function.

In lua, one can do n=setmetatable({},{_index = function() print"This will run" end}) _=n.anything

Not sure how we would do that with what we have so far...

so we somehow need to get (_=>_).constructor right?

We have that, it's []["fill"]["constructor"]

Creating those strings from only []+= of course

We just can't call the function.

right

We can only call the function with a single string as input, pretty much

[]["fill"]["constructor"]`+[]+[]`

and a string that can't contain backquotes, at that

Wait... do we have enough chars to get valueOf?

My word, we do

we do

I don't know if that will help though...

So great, we can get any letter.

@ATaco How's that?

it's not obvious to me how that helps

I was thinking we could modify the getter for something

I'm not exactly sure how .valueOf works though, I'll go look for docs

My mistake, I misunderstood what string.valueOf does.

oh right, we can assign to valueOf

and set a getter that way

I think this works, but how do we get underscore?

underscore for what

Or maybe we could reassign .toString

@ais523 I haven't found a way yet

Why do you need it though?

i mean for __defineGetter__ we're still missing a G i think

we may be able to use __defineSetter__?

I got recursion working :D

then set the value to run the function? (don't mind me, i have absolutely no idea what i'm doing)

@ETHproductions :O example?

a=[];a.toString=Function`a+[]`;a+[] gives a "too much recursion" error

idk if there would be anything usefull on 2ality

So now we can call functions without parentheses or backticks, but the problem is you can't pass arguments

But hey, we've got recursion, anything is possible

wait

you can make your own template strings? e.g. the `a+[]` there

Well, we've got a way to do variables using only []+=, lemme see if I can remember what is was

Also, where are we getting these ;s from?

Don't worry, it's just a proof of concept

[]["constructor"]["a"]=[] sets Function.a to the empty array (of course, we'd compute those strings with []+= too)

So []["constructor"]["a"]=[];[]["constructor"]["a"]["toString"]=[]["fill"]["constr‌​uctor"]`[]["constructor"]["a"]+[]`;[]["constructor"]["a"]+[] causes an infinite recursion error

That's a nightmare to read, this is going well.

I'm going to create a gist with the code to get every character so that I don't have to do it by hand every time