Skip to content
The seventh way to call a JavaScript function without parentheses
portswigger.net | research | #web-security | #javascript | #tagged-templates | #waf-evasion | #function-calls | #language-quirks
Summary
Gareth Heyes documents a seventh way to call JavaScript functions without parentheses, exploiting how tagged-template placeholders are passed as typed arguments — insight for sandbox and WAF evasion.
- Published
- Collected