Question: I was told today that it's possible to invoke a function without parentheses. The only ways I could think of was using functions like [`apply`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/apply) or [`call`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/call).

```
f.apply(this);
f.call(this);

```

But these require parentheses on `apply` and `call` leaving us at square one. I also considered the idea of passing the function to some sort of event handler such as [`setTimeout`](https://developer.mozilla.org/en-US/docs/Web/API/WindowTimers/setTimeout):

```
setTimeout(f, 500);

```

But then the question becomes "how do you invoke `setTimeout` without parentheses?"

So what's the solution to this riddle? How can you invoke a function in Javascript without using parentheses?

Answer: 
The easiest way to do that is with the `new` operator:

```js
function f() {
  alert('hello');
}

new f;
```

While that's unorthodox and unnatural, it works and is perfectly legal.

The `new` operator doesn't require parentheses if no parameters are used.
If we accept a lateral thinking approach, in a browser there are several API's we can abuse to execute arbitrary JavaScript, including calling a function, without any actual parenthesis characters.

### 1. `location` and `javascript:` protocol:

One such technique is to abuse the `javascript:` protocol on `location` assignment.

**Working Example:**

```js
location='javascript:alert\x281\x29'
```

Although *technically* `\x28` and `\x29` are still parenthesis once the code is evaluated, the actual `(` and `)` character does not appear. The parentheses are escaped in a string of JavaScript which gets evaluated on assignment.

---

### 2. `onerror` and `eval`:

Similarly, depending on the browser we can abuse the global `onerror`, by setting it to `eval`, and throwing something that will stringify to valid JavaScript. This one is trickier, because browsers are inconsistent in this behavior, but here's an example for Chrome.

**Working example for Chrome (not Firefox, others untested):**

```js
window.onerror=eval;Uncaught=0;throw';alert\x281\x29';
```

This works in Chrome because `throw'test'` will pass `'Uncaught test'` as the first argument to `onerror`, which is almost valid JavaScript. If we instead do `throw';test'` it will pass `'Uncaught ;test'`. Now we have valid JavaScript! Just define `Uncaught`, and replace test with the payload.

---

In conclusion:
--------------

Such code is **truly awful**, and **should never be used**, but is sometimes used in XSS attacks, so the moral of the story is don't rely on filtering parenthesis to prevent XSS. Using a [CSP](https://developer.mozilla.org/en-US/docs/Web/Security/CSP) to prevent such code would also be a good idea.