Sandboxing javascript module

Question

Is it possible to sandbox javascript module from DOM manipulation? Fo example

var Core = { 
    register: function(config){config.init()},
    publicApi: {
        msgbox: function(msg){alert(msg)} 
    } 
}
Core.register({
    name: 'testmodule',
    init: function(){
        /* from there i want to see only function defined in Core.publicApi, no jQuery direct access, no DOM */
    }
});

Answer 1

Well, somewhat: you can sandbox the function, but its callees will also be sandboxed. That means even stuff in Core.publicApi won't be able to access document and the like. Or, at least, there's no bulletproof sandboxing in Javascript that will allow that bridging.

You can cripple what's available by temporarily overwriting the window variable:

var window = {"Core": Core};

But then no global variable (even such as alert) will exist for the callees. This will most likely break your API.

You can add another member (like _unsandboxed or whatever) into the new window variable to allow your API to access the members. But, as I said, it's not bulletproof since sandboxed functions can still access _unsandboxed.