Hidden Firefox properties revisited

Tuesday, 14 July 2009

This is the first time I’ve looked at the Firefox source, really! 🙂 I wanted to find all the hidden properties Firefox has in Javascript. It was first pointed out to me by DoctorDan on the slackers forums when he found that the RegExp literal had a -1 value for the source in Firefox 2. I then made it my mission to find others because I thought it would be cool.

They seem to be flags within the source (Ronald mentioned this to me at some point too), I’m not sure how they are used internally or within Javascript. In the source code they are given the name tinyid so that’s what I’ll refer to them from now on.

Here’s how to use them:-

(function(){ alert(arguments[-3]) })()

Functions:-
CALL_ARGUMENTS = -1, predefined arguments local variable
ARGS_LENGTH = -2, number of actual args, arity if inactive
ARGS_CALLEE = -3, reference from arguments to active funobj
FUN_ARITY = -4, number of formal parameters; desired argc
FUN_NAME = -5, function name, “” if anonymous
FUN_CALLER = -6 Function.prototype.caller, backward compat

RegExp:-
REGEXP_STATIC_INPUT = -1,
REGEXP_STATIC_MULTILINE = -2,
REGEXP_STATIC_LAST_MATCH = -3,
REGEXP_STATIC_LAST_PAREN = -4,
REGEXP_STATIC_LEFT_CONTEXT = -5,
REGEXP_STATIC_RIGHT_CONTEXT = -6

REGEXP_SOURCE = -1,
REGEXP_GLOBAL = -2,
REGEXP_IGNORE_CASE = -3,
REGEXP_LAST_INDEX = -4,
REGEXP_MULTILINE = -5,
REGEXP_STICKY = -6;

E4X:-
NAMESPACE_PREFIX = -1,
NAMESPACE_URI = -2

QNAME:-
QNAME_URI = -1,
QNAME_LOCALNAME = -2

As I find more I’ll add them here, I know strings uses -1 for the length but I’ll wait till I find all of them for the string object.

The entry 'Hidden Firefox properties revisited' was posted on July 14th, 2009 at 9:28 am and is filed under javascript, Security. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

4 Responses to “Hidden Firefox properties revisited”

  1. Andrea Giammarchi writes:
    No. 1 — July 14th, 2009 at 9:44 am

    I wrote about arguments secrets few weeks ago but I tested performances as well. Length, as callee, cost definitively more to be exposed but if these property will be there with “use strict” they could save JS debug!

  2. Wladimir Palant writes:
    No. 2 — July 14th, 2009 at 3:55 pm

    Interesting, never knew that SpiderMonkey used negative indexes as property shortcuts (btw, it is simply an optimization feature – common properties can be found in a lookup table, makes accessing them faster and saves memory as well). But other than that – they are all exposed in one way or other. I wasn’t sure about the static RegExp properties, there is simply no proper documentation for those – but according to the source code they all have their representation as RegExp.foo properties. Interesting detail: accessing the properties by their index doesn’t always work in Firefox 3.5, particularly not for RegExp[-1] – RegExp.input works however.

  3. Gareth Heyes writes:
    No. 3 — July 14th, 2009 at 4:02 pm

    @Wladimir

    Actually it depends on which Object you’re using. The global RegExp object has different properties than the regexp literal so -1 does in fact work:-
    /a/[-1]

    Or to use it with the RegExp constructor:-
    (new RegExp(‘a’))[-1];

  4. Gareth Heyes writes:
    No. 4 — July 14th, 2009 at 4:15 pm

    Maybe it’s because these special properties are only applied once they become a new object and ignored for a global native object

«
»