The Spanner logo
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    • Home
    • Blog
      • Blog home
      • RSS
    • Login
    The Spanner logo

    The Spanner
    Web security blog

    Made by Gareth Heyes
    Follow me on Twitter: @garethheyes

    Javascript for hackers!

    Hackvertor logo
    Shazzer logo
    My Github account
    Recent posts
    Pure-CSS 3D world collision detection How to write a Hackvertor tagIntroducing Feedworm: A Privacy-First RSS Reader That Lives in DevToolsSpeedy RSVP extensionAutoVaderHackvertor history and tag finderShadow Repeater v1.2.3 releaseBurp Hackvertor v2.1.24 releaseHacking roomsXSSing TypeErrors in SafarivalueOf: Another way to get thisMaking the Unexploitable Exploitable with X-Mixed-Replace on FirefoxThe curious case of the evt parameterCSS-Only Tic Tac Toe ChallengeRewriting relative urls with the base tag in SafariBypassing DOMPurify with mXSSNew IE mutation vectorHow I smashed MentalJSMentalJS DOM bypassAnother XSS auditor bypassXSS Auditor bypassBypassing the IE XSS filterUnbreakable filterMentalJS bypassesmXSSJava SerializationBypassing the XSS filter using function reassignmentRPOSandboxed jQueryX-Domain scroll detection on IE using focusEpic fail IEnew operatorDecoding complex non-alphanumeric JavaScriptHacking FirefoxDOM ClobberingBypassing XSS AuditorThe evolution of codeNon-Alpha PHP in 6-7 charsetTweetable PHP-Non AlphaMentalJS for PHP

    Hidden Firefox properties revisited

    By Gareth Heyes (@hackvertor)

    Published 17 years 1 month ago • Last updated July 2, 2025 • ⏱️ 2 min read

    ← Back to articles

    This is the first time I've looked at the Firefox source, really! :) I wanted to find all the hidden properties Firefox has in Javascript. It was first pointed out to me by DoctorDan on the slackers forums when he found that the RegExp literal had a -1 value for the source in Firefox 2. I then made it my mission to find others because I thought it would be cool.

    They seem to be flags within the source (Ronald mentioned this to me at some point too), I'm not sure how they are used internally or within Javascript. In the source code they are given the name tinyid so that's what I'll refer to them from now on.

    Here's how to use them:-

    (function(){ alert(arguments[-3]) })()

    Functions:- CALL_ARGUMENTS = -1, predefined arguments local variable ARGS_LENGTH = -2, number of actual args, arity if inactive ARGS_CALLEE = -3, reference from arguments to active funobj FUN_ARITY = -4, number of formal parameters; desired argc FUN_NAME = -5, function name, "" if anonymous FUN_CALLER = -6 Function.prototype.caller, backward compat

    RegExp:- REGEXP_STATIC_INPUT = -1, REGEXP_STATIC_MULTILINE = -2, REGEXP_STATIC_LAST_MATCH = -3, REGEXP_STATIC_LAST_PAREN = -4, REGEXP_STATIC_LEFT_CONTEXT = -5, REGEXP_STATIC_RIGHT_CONTEXT = -6

    REGEXP_SOURCE = -1, REGEXP_GLOBAL = -2, REGEXP_IGNORE_CASE = -3, REGEXP_LAST_INDEX = -4, REGEXP_MULTILINE = -5, REGEXP_STICKY = -6;

    E4X:- NAMESPACE_PREFIX = -1, NAMESPACE_URI = -2

    QNAME:- QNAME_URI = -1, QNAME_LOCALNAME = -2

    As I find more I'll add them here, I know strings uses -1 for the length but I'll wait till I find all of them for the string object.

    ← Back to articles