-
Notifications
You must be signed in to change notification settings - Fork 182
/
Copy path72.a==1&&a==2&&a==3.js
96 lines (75 loc) · 1.54 KB
/
72.a==1&&a==2&&a==3.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
// 如何使得a==1 && a == 2 && a == 3为true
// 方式1:隐式转换
(() => {
let a = {
i: 1,
toString() {
return this.i++
}
}
console.log(a == 1 && a == 2 && a == 3)
})()
// 方式2:利用Object.defineProperty劫持的方式
; (() => {
let _a = 1
Object.defineProperty(window, 'a', {
get() {
return _a++
}
})
console.log(a == 1 && a == 2 && a == 3)
})()
// 方式3:利用Proxy劫持的方式
; (() => {
let a = new Proxy({ i: 1 }, {
get(target) {
return () => target.i++
}
})
console.log(a == 1 && a == 2 && a == 3)
})()
// 方式4:利用数组和join方法
; (() => {
let a = [1, 2, 3]
a.join = a.shift
console.log(a == 1 && a == 2 && a == 3)
})()
// 方式5:利用隐藏字段
; (() => {
let aᅠ = 1
let a = 2
let ᅠa = 3
console.log(aᅠ == 1 && a == 2 && ᅠa == 3)
})()
// 方式6:利用with
; (() => {
let i = 1
with ({
get a() {
return i++
}
}) {
console.log(a == 1 && a == 2 && a == 3)
}
})()
// 方式7:利用障眼法 修改if
; (() => {
const if = () => !0
let a = 9
if(a == 1 && a == 2 && a == 3)
{
console.log('hello world')
}
})()
// 方式8:利用valueOf和正则的匹配规则
; (() => {
let a = {
r: /\d/g,
valueOf: function () {
return this.r.exec(123)[0]
}
}
if (a == 1 && a == 2 && a == 3) {
console.log("hello world")
}
})()