Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Call by sharing: Understanding why JavaScript does NOT pass objects By Reference

For a long time I thought primitive types are shared by value and objects are shared by reference in javascript. Today I learned however that javascript always pass by value (According to the ECMAScript specification), both primitive types…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

For a long time I thought primitive types are shared by value and objects are shared by reference in javascript. Today I learned however that javascript always pass by value (According to the ECMAScript specification), both primitive types and objects. However when passing objects the value that is being passed is the reference.This behaviour is known as 'call by sharing' and NOT pass by reference. let's see why...






Call by Sharing: How JavaScript Passes Objects



Let's first see how primitive values are passed.



Consider the below code:




function setName(copyOfName){
copyOfName = "John";
}

let name ="Della";
setName(name);
console.log(name);// "Della"






It's pretty straightforward and easy to understand why primitive types are passed by value. Here we are passing the argument, 'name' that is assigned to the parameter, 'copyOfName'. That is, copyOfName now contains a copy of the variable, name, which has the value "Della". and reassigning copyOfName to "John" only affect this copy not the original name variable.



Now what if we were passing an object?



consider the below code:




function setPerson(copyOfPerson){
copyOfPerson.name = "John"; // here we are MUTATING
}

let person = {
name: "Della",
}
setPerson(person);
console.log(person); // { name: "John" }






Here we have an object person with name as "Della" which we are passing to the function's parameter, copyOfPerson by pass by value. But the value passed here is a copy of the reference. Hence both copyOfPerson and name point to the same object. Therefore, any modification or mutation (NOTE, I am mutating the object NOT re-assigning! - Big Difference) to the copy affects the original object since both point to the same object. That is why person becomes { name: "John" } when copyOfPerson is modified.



Now you might ask - isn't this what is known as 'Pass by Reference' ?!



Well...not really. The above code works the way it works fundamentally because an object variable contains a reference value.That reference value is itself the value stored in the variable. So technically, the reference is the value! And that's why we say javascript passes reference by value.



To prove programmatically, let's consider the below code, where we try to 're-assign' the copy.




function setPerson(copyOfPerson){
copyOfPerson = {
name: "John",
}// here we are RE-ASSIGNING
}

let person = {
name: "Della",
}
setPerson(person);
console.log(person); // { name: "Della" }






If the object was truly passed by reference, even reassigning would change the original object. However that is not the case. Here, local rebinding happens. a new object is created and it's reference is assigned to copyOfPerson. Therefore it no longer points to person and that is why person remains same ,{ name: "Della" }. This is called 'call by sharing' also known as 'call by object sharing'



To recap, JavaScript is a pass-by-value language. However, when passing objects, the value being passed is the reference to the object. This behaviour is known as call-by-sharing. In call-by-sharing, when an object is passed to a function, a copy of the reference is created and thus objects are shared. However, variable binding is not shared. So mutating the parameter modifies the original object but reassigning the parameter does not affect the original object.



Happy learning! cheers ✨

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Vulnerability Remediation & Verification
Syntax validiert (0 Fehler)
title: Detect Exploitation - Call by sharing: Understanding why JavaScript does NOT pass objects By Reference
id: 6cc57477-2f6d-4440-b723-94a3dcfc2169
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Call by sharing: Understanding" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Call by sharing Understanding why JavaSc")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Call by sharing Understanding why JavaSc*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Call by sharing Understanding why JavaSc"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Call by sharing: Understanding why JavaS.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Call by sharing: Understanding why JavaScript does NOT pass objects By Reference

Thematisch verwandte Begriffe: Call, sharing, Understanding, JavaScript · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100656 | Netty (io.netty:netty-codec-http) contains an unbounded per-connection …
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag