javascript - Overwriting the Array constructor does not affect [], right?

Question

I just read this: http://haacked.com/archive/2008/11/20/anatomy-of-a-subtle-json-vulnerability.aspx

I was under the impression that overwriting Object or Array only had an effect if you chose to use the constructor functions when creating arrays/objects, but, according to that article, it also has an effect on literal creation ({} and [])...

My logic:

Array = function(){ alert('Hi'); };

[1,2,3,4,5];
([1,2,3,4,5]);
var a = [1,2,3,4,5];

// ...
// ... Nothing is alerted

So, am I going crazy or are there some implementation-specific quirks I'm not aware of?

Answer 1

As far as I know this is an issue with the ECMAScript specification and was fixed in all major browsers over a year ago. Here is a link that links you to the most relevant links ;)

But to actually answer your question, yes, the Object and Array constructors are also invoked for literal creations. The fix browsers implemented just made these (and others) constant so they can't be overridden by custom scripts.