This is pretty cool. Reminds me of a Defcon presentation that only used whitespace characters to encode the script (and a bit of boilerplate). I think it looks less suspicious than lots of symbols lumped together.
For those like me who stumble upon this type of js expressions for the first time and are scratching their heads, John Resig (of jQuery fame) attempted some basic explanations in this old HN post:
Wow, I knew the + operator was weird, but didn't realise it allowed you to do stuff like that.
What I don't get though, wouldn't you still need to call eval() on it to do anything with it? Or does javascript do a 'implied eval' when you try to call a string?
Some people think that they can secure their sites against XSS by regexing all the "bad JavaScript" out. If the "security software" sees "document.cookie", then it stops the script from executing. (Or it just replaces it with the empty string, etc.)
Problem is, there are a lot of ways to say document.cookie, and a blacklist is going to miss one of them.
Moral of the story: if people can execute scripts on your page, you're 0wned. Everyone competent knows this, but sometimes the less competent are slow to realize this.
So, the script that the article describes is for their benefit. Good luck writing a regex to stop this one...
(There are also even simpler "exploits", if you regex document.cookie to the empty string, then "document.document.cookiecookie" regexes to "document.cookie". Ooops.)
Sanitize both input and output. Make sure everything outputted is encoded. < to > > to <, " to "e;, etc. As long as all they can write is normal characters then you're safe [1].
[1] Or rather, safer. There are always obscure ways to get around almost everything. So you really have to take care to exactly the situation you're in at the moment.
Sanitize everything, use multiple redundant sanitizer libraries (there are several out there that handle different things), and use a whitelist, rather than a blacklist, based approach. If you want to allow the use of <a> tags, enforce that they adhere to the exact format of a safe <a> tag, otherwise encode or strip them. One look at the XSS cheatsheet page should be enough to convince any sane developer of the futility of a blacklist-based approach.
If all those blackhat-efforts could be put to better use somewhere.. although its fascinating what _can_ be done. They are truly creative in their own way. :)
I'm a little confused. It seems like he didn't need to call the sort function in order to call the alert function. Is this correct? He could have built the alert call in the same manner and just call it by itself. I assume the sort function was thrown in there for a larger example?
The reddit link in the post right above yours explains that sort is used to get a reference to the "window" object since sort returns "this" and by assigning it to a variable it returns the default context which in this case is "window".
Searching for this string on Google, as I have no access to blogspot, I fell down on http://asdfg.jodi.org (js art, NSFW and may kill your browser). It is related, somewhat.
The second $ (which is actually the first assignment) was used as as an alias to [] before the first $ gets assigned. I guess to reduce the number of characters.
the code unobfuscated is:
(a=[a=[]]['sort'])()['alert'](1)
my argument is that this is the same, and less chars
(a=[]['sort'])()['alert'](1)
I can't see any benefit of the encapsulation of the array assignment there.
edit: also, just noticed that my previous comments i was writting $=[[]] when i was thinking of $=[], but both works the same, and are still less chars :)
here i kept $, only step 11 required [] instead of $
i'm guessing step 14 is actually executed earlier... or that undefined has the same effects as [] for most of those stringfying hacks.
Update: no, undefined trhows an error. so step 14 is earlier... let me replace all that with a eval function that also stores the run order. then i will post the correct ordering.
And the forum thread where this technique was explored at length: http://sla.ckers.org/forum/read.php?24,33349,33405
Superfun. :D