Discussion between Евгений Новиков and Voile

Feeds

09:06

JavaScript (ES6), 173 169 163 150 bytes Let's have something totally different... and totally evil. c=Object.freeze,c(''[g='__proto__']),c([].g),f=s=>(t=s.slice(),u=t.split`\n`,typeof s=='string'&&u.length<81&&u.every(l=>l.length<3)&&eval(t)(t)),c(f) Usage: f('Hello, World!') Try it online!

Евгений Новиков

You can replace Object.freeze to {}.freeze

Voile

Thanks, golfed 4 bytes.

Евгений Новиков

And maybe c(String.prototype),c(Array.prototype) to c([].__proto__),c("".__proto__)

function can be transformed pastebin.com/NyKxFwBw

Voile

Thanks, I took it and golfed even further. (Also I just figured out {}.freeze doesn't actually work, so I reverted it back.)

Now it's 150 bytes. I hope that I didn't introduce any vulnerabilities by turning everything in global scope.

Евгений Новиков

@Volie [].__proto__ != String.prototype

Voile

09:21

Oops, fixed that oversight

Евгений Новиков

09:49

Seems that not. I'm sorry about bad suggestions. Only one usable suggest is function edit pastebin.com/NyKxFwBw

@Voile f=a=>(x,y,z) is function, that returns z and do x and y. If no while/for, it can be replaced

Voile

I know that

the current version should be right though

the first 3 conditions need to be true in order for the code to get to the eval part

so that'd be a chain of &&s

Евгений Новиков

10:25

@Voile Now it uses __proto__ to freeze object. Is it OK? Seems, that i can cause backdoors

it*

Voile

[] and {} doesn't expose 'prototype' though

and I can't just freeze the whole thing, otherwise the language runtime itself breaks

though my own testing doesn't seem to expose any backdoors

Евгений Новиков

Is Object.freeze(String.prototype) equivalent to Object.freeze("".__proto__) ?

Voile

docs.microsoft.com/en-us/scripting/javascript/reference/… seems yes

''.__proto__ === String.prototype

2 hours later…

Евгений Новиков

12:03

yes, is it

it is

Birjolaxew

@Voile Your edit to fix overwriting eval doesn't work. Freezing it only stops people from changing properties on it, not from overwriting it. You'll have to store the initial value of eval in your scope.

3 hours later…

Евгений Новиков

14:53

About 8th revision

@Volie Good idea to const functions. Anyway there is backdoor, but i suggest to don't care about it, because it doesn't fixable. It named Function.prototype.call

I divide solutions to hacks and cracks. call in proto is hack, expected solution is crack. Another example

3 hours later…

Voile

17:29

yeah, that'd be too much to patch around, and frankly if we've reach that kind of stuff then obviously it's more like a hack than a crack (you can do pretty much anything with those)

Евгений Новиков

agree

Voile

17:45

anyways, I'm now writing a meta post asking about valid types of input for input CnR challenges

I don't think this has ever been brought up yet, so it definitely worths some discussion

Voile

18:05

Q: Viable input forms in Cops and Robbers challenges

So, recently in the Hello World CnR challenge I've come across this crack to my submission. I don't think it's ever clearly defined before in any CnRs what exactly is allowed as an input and what is not. So, what exactly consitutes a input to a function? What is allowed and what is not allowed?