AAA

AAA

. 2 min read

The code

const A = new Proxy([], {
    get: (A, А, Α) =>
        ((A.A = (A.A ?? '') + А.replace(/(.)(.)/g, (A, А, Α) => А + Α.toUpperCase()) + ' '),
            А === '' ? A.A : Α)
});

console.log(A.never.gonna.give.you.up['']);

// prints "nEvEr gOnNa gIvE yOu uP"

The Explanation

Okay... there's a lot to unpack here.

Although it may look like every variable is an A, that is not the case. Some of them are the Latin A character, others are the Cyrillic А character, and the rest are the Greek Α (Alpha) character. Although they look identical, they have differing Unicode code points so JavaScript engines treat them as unique. To demonstrate, here is the same code as above but with the various As replaced with the name of the language they come from:

const latin = new Proxy([], {
    get: (latin, cyrillic, greek) =>
        ((latin.latin = (latin.latin ?? '') + cyrillic.replace(/(.)(.)/g, (latin, cyrillic, greek) => cyrillic + greek.toUpperCase()) + ' '),
            cyrillic === '' ? latin.latin : greek)
});

console.log(latin.never.gonna.give.you.up['']);

Now to make them more descriptive:

const stringBuilder = new Proxy([], {
    get: (target, prop, receiver) =>
        ((target.text = (target.text ?? '') + prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase()) + ' '),
            prop === '' ? target.text : receiver)
});

console.log(stringBuilder.never.gonna.give.you.up['']);

Alright, that's almost readable now. Time to get into the meat of the issue: a combination of Proxy usage and deliberately bad code practices.

Proxy is a handy native JavaScript object that binds to another object and intercepts (proxies) various forms of access. In this case, stringBuilder is a Proxy bound to an empty array [], capturing all get calls. The above get function is called every time a property is accessed, providing not only information about the request but a way to return the spoofed data necessary to pull off the AAA trick.

Time to expand the code a bit more.

const stringBuilder = new Proxy([], {
    get: function (target, prop, receiver) {
        target.text = (target.text ?? '') + prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase()) + ' ';
        return prop === '' ? target.text : receiver;
    }
});

console.log(stringBuilder.never.gonna.give.you.up['']);

Let's get the replace out of the way first.

prop.replace(/(.)(.)/g, (unused, match1, match2) => match1 + match2.toUpperCase())

This takes whatever property is trying to be accessed and converts every other letter to uppercase, starting with the second letter. Click here for a demo of the /(.)(.)/g regex.

The rest of line 3 just appends the now-capitalized prop (e.g. "nEvEr" or "gOnNa") to the proxied array's text property.

If the property requested is an empty string (prop === ''), stringBuilder returns the completed text. Otherwise, it returns stringBuilder itself to allow further chaining. stringBuilder.never is just a reference to stringBuilder, as is stringBuilder.never.gonna.give.you.up. Only when you append it with [''] does it return the completed string.