### Wee Token

The last of the assert challenges, this one focuses on the `assert_string()`
statement, which checks to see if an input string is actually a string.

```javascript  
externals.addFunction(  
// Wee is statically typed. Finding a way to confuse the VM is impossible.  
"assert_string",  
[{name: "str", type: compiler.StringType}], compiler.StringType,  
false,  
(str: string) => typeof str == "string" ? "WEE is statically typed. Sorry,
confusing the VM is impossible."  
: flags.WEE_TOKEN  
)  
```

One option we have is to use the `eval()` JavaScript function to our
advantage. This function takes a string input that represents a JavaScript
expression, and returns the completion value of evaluating the expression as a
string. However, if it's given an empty string as input, it will return
`undefined`, which has its own type. So now if we use
`alert(assert_string(eval('')))` as the value for the `code` parameter in our
POST request to `/wee/run`, we'll get our flag.

[This Python
script](https://github.com/AndreyRainchik/Writeups/tree/master/35c3%20junior/files/flag_scripts/weetoken.py
"Python script to get the flag") will run through this process and print out
the flag of `35C3_WEE_IS_TINY_AND_SO_CONFU5ED`

Original writeup
(https://github.com/AndreyRainchik/Writeups/tree/master/35c3%20junior#wee-
token).