Today encountered an interesting problem, hereby record
leta = ? ; (a==1 && a==2 && a==3) {
console.log('yes')}Copy the code
The valueOf a can be changed by rewriting the num method. The valueOf a can be changed by rewriting the num method. The valueOf a can be changed by rewriting the num method.
let a = {
val: 1.toString() {
returna.val++; }}Copy the code
This can also be done with Object.defineProperty
let num = 0;
Object.defineProperty(window.'a', {
get() {
return++num; }})Copy the code
conclusion
- When using object comparison
toString
The method of - using
Object.defineProperty
hijackedJS
The object’sgetter