JS Functions Called Without Parentheses
Original: Yet another way to invoke functions without parentheses
Why This Matters
Adds another parenthesis-free JS gadget to the XSS and CSP-bypass toolkit.
A security researcher found a new JavaScript technique to invoke arbitrary functions without parentheses, using Error.prepareStackTrace, prototype pollution, and the valueOf trick in a compact one-liner payload.
Bartosz published a technique that chains several JavaScript quirks to call arbitrary functions without ever using parentheses — a classic constraint in browser-based XSS filter bypasses and CSP evasion challenges.
The core idea: `Error.prepareStackTrace` is normally used to format stack traces and fires when `.stack` is accessed on an Error object. Critically, it shares a signature with the `Function` constructor — meaning it can generate executable functions if fed valid JavaScript code as its second argument.
The problem is that a real stack trace isn't valid JS. So the payload also hijacks `Array.prototype.toString`, pointing it at `Error.prototype.toString` instead. By polluting `Object.prototype.message` with the desired payload string (e.g., `alert(1337)`), the array-to-string conversion now returns attacker-controlled code.
With a callable function in hand, invocation is handled via the `valueOf` trick: overwrite the object's `valueOf` with the generated function, then force primitive conversion using the unary `+` operator.
The final payload fits in one line: `Object.prototype.message='alert\x281337\x29';Array.prototype.toString=Error.prototype.toString;Error.prepareStackTrace=Function;const x=new Error;x.valueOf=x.stack;+x;`
The author notes alternative invocation paths exist, including `toString` with string concatenation.