JavaScript timers can be bypassed with “Infinity”

Re:JavaScript timers can be bypassed with “Infinity” by code4money on Wednesday July 28, 2021 @08:11PM (#27991318)

Will bypass a few validations if server accepts as param from client:

Number(Infinity) -> Infinity

Infinity < 5000 -> will return false even though Infinity is acting as a 0 here

[ Parent | on HN ]

Re:JavaScript timers can be bypassed with “Infinity” by exevp on Thursday July 29, 2021 @01:28AM (#27993080)

This is probably a good opportunity to have a heated discussion over parseInt() vs Number() since parseInt('Infinity') yields NaN. I know people prefer Number() for reasons but in this case it reveals the weakness of using basically a typecast with implicit language semantics for interpreting string inputs.

[ Parent | on HN ]

Re:JavaScript timers can be bypassed with “Infinity” by goldenkey on Thursday July 29, 2021 @04:07PM (#28000829)

parseFloat('Infinity'), JSON.parse('1e1024'), or parseFloat('1e1024') work just fine ;-)

[ Parent | on HN ]