The code
const A = new Proxy([], {
get: (A, А, Α) =>
((A.A = (A.A ?? '') + А.replace(/(.)(.)/g, (A, А, Α) => А + Α.toUpperCase()) + ' '),
А === '' ? A.A : Α)
});
console.log(A.never.gonna.give.you.up['']);
// prints "nEvEr gOnNa gIvE yOu uP"
The Explanation
Okay... there's a lot to unpack here.
Although it may look like every variable is an A
, that is not the case. Some of them are the Latin A
character, others are the Cyrillic А
character, and the rest are the Greek Α
(Alpha) character. Although they look identical, they have differing Unicode code points so JavaScript engines treat them as unique. To demonstrate, here is the same code as above but with the various A
s replaced with the name of the language they come from:
const latin = new Proxy([], {
get: (latin, cyrillic, greek) =>
((latin.latin = (latin.latin ?? '') + cyrillic.replace(/(.)(.)/g, (latin, cyrillic, greek) => cyrillic + greek.toUpperCase()) + ' '),
cyrillic === '' ? latin.latin : greek)
});
console.log(latin.never.gonna.give.you.up['']);
Now to make them more descriptive:
const stringBuilder = new Proxy([], {
get: (target, prop, receiver) =>
((target.text = (target.text ?? '') + prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase()) + ' '),
prop === '' ? target.text : receiver)
});
console.log(stringBuilder.never.gonna.give.you.up['']);
Alright, that's almost readable now. Time to get into the meat of the issue: a combination of Proxy usage and deliberately bad code practices.
Proxy is a handy native JavaScript object that binds to another object and intercepts (proxies) various forms of access. In this case, stringBuilder
is a Proxy bound to an empty array []
, capturing all get calls. The above get
function is called every time a property is accessed, providing not only information about the request but a way to return the spoofed data necessary to pull off the AAA trick.
Time to expand the code a bit more.
const stringBuilder = new Proxy([], {
get: function (target, prop, receiver) {
target.text = (target.text ?? '') + prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase()) + ' ';
return prop === '' ? target.text : receiver;
}
});
console.log(stringBuilder.never.gonna.give.you.up['']);
Let's get the replace
out of the way first.
prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase())
This takes whatever property is trying to be accessed and converts every other letter to uppercase, starting with the second letter. Click here for a demo of the /(.)(.)/g
regex.
The rest of line 3 just appends the now-capitalized prop
(e.g. "nEvEr"
or "gOnNa"
) to the proxied array's text
property.
If the property requested is an empty string (prop === ''
), stringBuilder returns the completed text. Otherwise, it returns stringBuilder itself to allow further chaining. stringBuilder.never
is just a reference to stringBuilder
, as is stringBuilder.never.gonna.give.you.up
. Only when you append it with ['']
does it return the completed string.