Closed
Description
<canvas id=a><script>/* Roadroller output from a JS code using a */</script>
This won't work, because a
(among others) gets assigned during the decompression and it shadows window.a
.
The problem is that this might be okay depending on the input, and we definitely want to exploit that whenever possible. There are ~16 variables used by Roadroller, carefully chosen so that the decoder gets compressed more, and changing any of them can have undesirable effects. One possible resolution is to put everything into a giant function:
eval(((A='....', t=1234, a, c, f, l, ...) => {
/* code */
})())
But I'm not sure how to make it compatible with multiple inputs (#8).
Workaround
For now you should avoid using the following ids in your HTML, either outside <script>
or written with document.write
.
A M a c e f l m o p r t u w x y
If you can't avoid using them there are two other workarounds:
- Prepend
window.
to all uses of such variables. - Put
delete VARIABLE;
for all affected variables at the beginning of your code.