Injecting self-executing function as value in JS object

Question

I am writing a simple library that will read values from an object given a string property.

Is it possible to read the property but have a function execute without actually invoking the function?

something like:

var obj = {

fn : (function malicious(){    deleteLotsOfFiles();
})()

}

if I do

var foo = obj.fn;

is there a way just by reading the property to execute a (malicious) function?

You can define a getter for a property using [MDN: Object.defineProperty()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/defineProperty) you could also look at that question [how to use javascript Object.defineProperty](http://stackoverflow.com/questions/18524652/how-to-use-javascript-object-defineproperty) — t.niese, Feb 11 '16 at 18:47

score 2 · Answer 1 · answered Feb 11 '16 at 18:41

2

The malicious function would have already executed anyway before you even referenced it. Once the function is parsed by the engine, it is executed straight away (self-invoking).

answered Feb 11 '16 at 18:41

Reda

1,361
10
12

score 2 · Answer 2 · answered Feb 11 '16 at 19:26

2

var obj = {
    get fn() { deleteLotsOfFiles(); }
};

// later
var o = obj; // deleteLotsOfFiles has not been executed
console.log(o.fn); // you just deleted lots of files

answered Feb 11 '16 at 19:26

yurisich

6,991
7
42
63

Matt · Answer 3 · 2016-02-11T20:05:04.693

An alternative

var o = Object.defineProperty(o, 'baz', {
    get: function(){
        console.log("Delete Everything!");
    } 
});

Then access o.baz and they are deleted

More Information on getters from MDN

Sometimes it is desirable to allow access to a property that returns a dynamically computed value, or you may want to reflect the status of an internal variable without requiring the use of explicit method calls.

Seems pretty much like what you want to do.

Injecting self-executing function as value in JS object

3 Answers3