Javascript 数组越界函数

发布于 2025-01-11 10:40:53 字数 242 浏览 0 评论 0原文

在 javascript 中，当索引超出数组范围时，它会以未定义的形式扩展。

幕后是否发生了任何函数调用？

例如：

var w = []
for (i = 0; i < 10; i++) {
    w[(i << 4) + 15] = i
}

我正在尝试一些原型中毒练习，我注意到一个数组与超出其范围的索引一起使用，所以我希望如果可能的话修改与此相关的函数。

原文

in javascript when an index is out of the bounds of the array, it gets extended with undefineds.

Are there any function calls happening behind the scenes?

For example:

var w = []
for (i = 0; i < 10; i++) {
    w[(i << 4) + 15] = i
}

I am trying some prototype poisoning exercises and I noticed an array used with indexes outside its bounds, so I am hoping to modify functions related to this if it is possible.

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

鼻尖触碰 2025-01-18 10:40:53

您可以使用代理：

const arr = new Proxy([], {
    get(target, property) {
        return target[property];
    },
    set(target, property, value) {
        // do your work here ... for example: print some values:
        console.log('oldValue=', target[property]);
        console.log('newValue=', value);
        console.log('index=', property);

        // set the new value - default behaviour
        target[property] = value;

        // Return true if successful. In strict mode, returning false will throw a TypeError exception.
        return true;
    },
});

arr[3] = 'https://sidanmor.com/';

You can use Proxy:

const arr = new Proxy([], {
    get(target, property) {
        return target[property];
    },
    set(target, property, value) {
        // do your work here ... for example: print some values:
        console.log('oldValue=', target[property]);
        console.log('newValue=', value);
        console.log('index=', property);

        // set the new value - default behaviour
        target[property] = value;

        // Return true if successful. In strict mode, returning false will throw a TypeError exception.
        return true;
    },
});

arr[3] = 'https://sidanmor.com/';

回复收藏 0 原文

音盲 2025-01-18 10:40:53

您可以像这样重写 Array.prototype：

注意 for 循环中的限制！

for (let i = -1000; i < 1000; i++) {
    Object.defineProperty(Array.prototype, i, {
        get() {
            if (this[`_${i}`] === undefined) return 'No value'; // or throw new Error('No value');
            return this[`_${i}`];
        },
        set(v) {
            return this[`_${i}`] = v;
        },
    });
}

const arr = [];

console.log(arr[1]); // No value
arr[1] = 'I have a value'; // set value
console.log(arr[1]); // get the value 'I have a value'
console.log(arr[-1]); // No value
console.log(arr[-100]); // No value
console.log(arr[0]); // No value
console.log(arr[100]); // No value
console.log(arr[10000]); // undefined (because of the limits are -1000 to 1000)

You can override Array.prototype like this:

NOTE the limits in the for loop!

for (let i = -1000; i < 1000; i++) {
    Object.defineProperty(Array.prototype, i, {
        get() {
            if (this[`_${i}`] === undefined) return 'No value'; // or throw new Error('No value');
            return this[`_${i}`];
        },
        set(v) {
            return this[`_${i}`] = v;
        },
    });
}

const arr = [];

console.log(arr[1]); // No value
arr[1] = 'I have a value'; // set value
console.log(arr[1]); // get the value 'I have a value'
console.log(arr[-1]); // No value
console.log(arr[-100]); // No value
console.log(arr[0]); // No value
console.log(arr[100]); // No value
console.log(arr[10000]); // undefined (because of the limits are -1000 to 1000)

回复收藏 0 原文

~没有更多了~