No-alphanumeric code exec

Question

Introduction

In most interpreted languages, there is an operation that will run code generated at runtime. It generally requires alphanumeric characters to refer to this operation. Write a program, using as few alphanumeric characters as possible, that is able to download and execute any string in the language you're working with, using as few alphanumeric characters as possible.

Informal bonus points for commonly used languages where this is a very difficult task, such as python.

Challenge

Inputs: a url to code in your language of choice, via either stdin or argv.

Outputs: output of executing the downloaded code.

Your program must generate the string to execute and call the eval/exec function/operator without reading from any existing files (excluding the file readings done by your interpreter of choice on startup and reading of standard library files by your language's import mechanism).

Winning entries must be written using only printable ascii characters. Compiled languages are allowed, if you can find a way to invoke the same compiler at runtime with the same settings.

Submissions will be scored, per-language, based on who uses the fewest executable alphanumeric characters. Non-alphanumeric characters do not count towards your score, nor do comments - try to make your non-alphanumeric code readable.

Input and Output example

Contents of my example target gist for python:

print("run by no-alphanum code exec")

example run:

$ python noalpha.py https://gist.githubusercontent.com/lahwran/77e94ef11493d4f36c726efe030f58e4/raw/5f7a0483a9fe7928ae2cf3f786d6d35f9d7870b9/example.py
run by no-alphanum code exec
$

Answer 1

Python 2, 5 alphanumerics

__=-~-~([]==[])
__*=__
_=__*-~-~-~__
exec('%c'*~-~-~-(__*~-~-__))%(~-~-~-_,-~_,-~-~-~-~_,-~-~-~_,-~-~-~-~-~-~_,-~-~-~-~-~-~-~-~_,' ',_+__,-~-~-~-~-~-~_,_,_,~-~-~-_,~-_-__,' ',~-~-_-__,-~-~-~-~-~-~-~_,' ',_+__,',',-~-~-~-~-~-~-~_,-~-~-~-~_+__,-~-~-~-~-~-~-~_,';',~-~-~-~-~-~-~-_,-~-~-~_+__,~-~-~-~-~-~-~-_,_-__,' ',_+__,'.',_+__,-~-~-~-~-~-~_,_,-~-~-~_,-~-~-~-~_,~-~-~-~-~-~-~-_,-~-~_,'(',-~-~-~-~-~-~-~_,-~-~-~-~_+__,-~-~-~-~-~-~-~_,'.',~-~-_-__,-~-~-~-~-~-~_,~-~-~-~-~-_,-~_+__,'[','_','=','=','_',']',')','.',-~-~-~-~-~-~_,~-~-~-~-~-~-~-_,~-~-_-__,~-~-~-~-~-~-~-~-_,'(',')')

Try it online (with print not exec)

It helps with a bit of experience with Symbolic Python, where alphanumerics are banned anyway. This is rather lazily golfed and could probably be a few dozen bytes shorter, but hey, this isn't code-golf. The 5 alphanumerics here are the exec and the c of %c. If we were allowed unprintables, the %c could be bypassed with the help of the repr operator `.

The executed format string translates to import urllib as u,sys;exec u.urlopen(sys.argv[_==_]).read(), which fetches the resource and executes it.

Explanation:

Python can use variables with names entirely composed of underscores, which really helps us. It also treats True/False as 1/0, which means we can compose numbers entirely without alphanumerics. For example, the first part of the code does:

__=-~-~([]==[])   # Set __ to 3
__*=__            # Square it to 9
_=__*-~-~-~__     # Set _ to 9*12 = 108

Here's where we reach the unavoidable letters. To make letter in a string, we can use %c in a format string to take a number and return the character with that ordinal value. We can then pass this string into the exec statement and voila! We can execute arbitrary code with only 5 alpha-numerics. The majority of the rest of the code is just repeating the %c enough times, then creating the numbers representing each letter.

Answer 2

Javascript, 0 Alphanumerics

This is my first answer, so hopefully I haven't accidentally broken a rule :)

Here's the code before extreme obfuscation:

var str = prompt("Enter relative URL of code to exec:", "");
var xhr = new XMLHttpRequest();
xhr.open('GET', str, true);
xhr.onreadystatechange = function() {
  if (xhr.readyState === 4)  { 
    eval(xhr.responseText);
  }
};
xhr.send(null);

It isn't verified, and neither is the obfuscated (and de-alphanumerized) version.

I used a form of obfuscated JS which you can find here. The actual solution is more than 220,000 characters long. It does have to be run in a browser. Also, there are no comments in the obfuscated code, but the de-obfuscated code speaks for itself if you have JS experience.

There are several online translators.

It takes the input URL through a prompt. You have to run it in a web browser while on the domain that the code is on.

Here's a link to the file, since pastebin lagged out after I pasted it: Source file

Answer 3

Bash, 4 alphanumerics

wget $@
. ${@##*/}

No TIO link because TIO doesn't have hostname resolution.