0

How can I check if 2 variables with the same value are the same variable?

For example in the below code I created 2 variables with the same values and i pass:

function check_var(v){
  // Check if "v" (string) came from a or b
}

let a = "string";
let b = "string";

check_var(b);

I able to install v8 engine locally and change the the source code, but i am looking for more easy way to do it.

One way to do it is if I had a method in javascript that returns a unique value for each variable based on the variable name.

One more way to solve the problem is by logging all the javascript actions, by doing that i could see after the code executed if var a is the var that got into the check_var function.

eyal
  • 107
  • 1
  • 7
  • Does this answer your question? [Variable name as a string in Javascript](https://stackoverflow.com/questions/4602141/variable-name-as-a-string-in-javascript) – SnoopFrog Jan 07 '23 at 02:23
  • 6
    This isn’t possible from within JavaScript; you’d use reference types instead, e.g. objects or symbols. Are you actually trying to write a JS engine or transpiler or something similar? For what purpose are you trying to install V8 and change the source code? See [XY problem](//meta.stackexchange.com/a/66378/289905) and make sure your question doesn’t have it. – Sebastian Simon Jan 07 '23 at 02:26
  • Perhaps look into parsing systems that already exist ie [abstract syntax trees](https://en.wikipedia.org/wiki/Abstract_syntax_tree)? Here is your above snippet parsed: [AST Explorer](https://astexplorer.net/#/gist/068302f2b463cacbc96bd88744970f84/32410f001dda8793e671e649eb97585324ec4db6). If you click on the 'JSON' tab you'll see your call is parsed and the argument name identified. – pilchard Jan 07 '23 at 02:31
  • No i just want to know if i can see the different between 2 variable with the same value using javascript @Sebastian Simon – eyal Jan 07 '23 at 02:32
  • 2
    The answer is "no" then. The value holds no reference to the variable it is assigned to. (also by the time you are dealing with `v` it is a new variable, neither `a` or `b`, so you would have to look at the call itself `check_var(b)`) – pilchard Jan 07 '23 at 02:32
  • 1
    @eyal And again: _why_ do you think you need to know this? – Sebastian Simon Jan 07 '23 at 02:37
  • I create my own dynamic xss scanner and i want to know if location.hash for example passed in the document.write function even if i do something like: let e = document.hash;document.write(e); – eyal Jan 07 '23 at 02:40
  • Then an AST is probably closest to this goal, e.g. ESTree. Still, this doesn’t sound robust at all. Why would the hash play a role in XSS? Why is the hash even there? If you’re worrying about XSS, this is probably the least of your concerns… – Sebastian Simon Jan 07 '23 at 02:45
  • document.location.hash and document.write is just example of a place where attacker can send the xss payload and function that execute javascript it called DOM xss. – eyal Jan 07 '23 at 02:49
  • The AST is very nice for static analysis however to check in runtime it doesnt help. – eyal Jan 07 '23 at 02:52

1 Answers1

1

In general you cannot, JavaScript doesn't have a universal identity equality operator.

Strings, numbers and some other simple values can only be compared by value. Tho objects, including arrays are compared by identity.

const a = [1]
const b = [1]

a===b // false

If this is important you could box the value

const a = { value: 'string' }
const b = { value: 'string' }
const c = a

a.value === b.value // true
a === b // false
a === c // true
everett1992
  • 2,351
  • 3
  • 27
  • 38