The seventh way to call a JavaScript function without parentheses
portswigger.net | research | #web-security | #javascript | #tagged-templates | #waf-evasion | #function-calls | #language-quirks
Summary
Gareth Heyes documents a seventh way to call JavaScript functions without parentheses, exploiting how tagged-template placeholders are passed as typed arguments — insight for sandbox and WAF evasion.
- Published
- Collected
--- id: 5463 title: "The seventh way to call a JavaScript function without parentheses" source_domain: portswigger.net source_url: "https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses" published_at: "2022-09-18T17:20:00Z" tags: ["web-security", "javascript", "tagged-templates", "waf-evasion", "function-calls", "language-quirks"] phying_url: "https://phying.com/item/5463" lang: en --- # The seventh way to call a JavaScript function without parentheses ## Summary Gareth Heyes documents a seventh way to call JavaScript functions without parentheses, exploiting how tagged-template placeholders are passed as typed arguments — insight for sandbox and WAF evasion. ## Intelligence Metadata - **Sources:** portswigger.net - **Published:** 2022-09-18T17:20:00Z - **Original:** https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses - **Phying News:** https://phying.com/item/5463