Embedding Javascript in Javascript (I'm serious)?

Question

I'm working on a project where players can place graphical objects on a website and animate them with scripts. As the scripts are going to be shared to all participating clients, the scripting environment must be sandboxed, so that users can't ultimately destroy other users experience for all parts of the page.

It is crucial that the scripts can access shared visual content. Therefore I can't isolate them in iframes entirely - besides that I'm wondering if there's a smoother approach to separate contexts.

I have been dabbling with a native version, where I used separate contexts using the V8 javascript engine, but now I want to bring this to the browser - even if it's just Google Chrome only.

Got any ideas?

possible duplicate of Is It Possible to Sandbox JavaScript Running In the Browser? — Jani Hartikainen
– Jani Hartikainen, Commented Aug 26, 2011 at 8:08
I agree that an iframe is probably the best way to go, but you might want to take a gander at jsfiddle.net. not sure how they do it but the source code is available on github so you can take a look at how others manage user inputted scripts on a parent page. — totallyNotLizards
– totallyNotLizards, Commented Aug 26, 2011 at 8:15

Community · Accepted Answer · 2017-05-23 11:55:45Z

3

Sandboxing JavaScript is inherently difficult, chances are that the script will manage to break out no matter how hard you try. A better course of action might be loading the scripts into an iframe without direct access to the main frame and allowing it to communicate with the main frame via window.postMessage(). You could then define an API that the frame is allowed to use this way without being given too much power.

Edit: Same thing is possible with Web Workers as noted in Is It Possible to Sandbox JavaScript Running In the Browser?, browser support for web workers isn't quite as widespread as for window.postMessage() however (compare http://caniuse.com/#search=postMessage and http://caniuse.com/#search=workers).

edited May 23, 2017 at 11:55

CommunityBot

11 silver badge

answered Aug 26, 2011 at 8:11

Wladimir Palant

57.8k12 gold badges100 silver badges129 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Embedding Javascript in Javascript (I'm serious)?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related