Is there a way to jail in Javascript, so that the DOM isn't visible

Question

I would really like to provide the user some scripting capabilities, while not giving it access to the more powerful features, like altering the DOM. That is, all input/output is tunneled thru a given interface. Like a kind of restricted javacsript.

Example: If the interface is checkanswer(func) this are allowed:

checkanswer( function (x,y)={
   return x+y;
}

but these are not allowed:
alert(1)
document.write("hello world")
eval("alert()")

EDIT: what I had in mind was a simple language that was implemented using javascript, something like http://stevehanov.ca/blog/index.php?id=92

Answer 1

Sounds like you need to process the user entered data and replace invalid mark-up based on a white list or black-list of allowed content.

Answer 2

T.J. Crowder makes an excellent point about the "arms race." It's going to be very tough to build a watertight sandbox.

it's possible to override certain functions, though, quite easily.

Simple functions:

• JavaScript: Overriding alert()

And according to this question, even overriding things like document.write is as simple as

document.write = function(str) {}

if that works in the browsers you need to support (I assume it works in all of them), that may be the best solution.

Alternative options:

• Sandboxing the script into an IFrame on a different subdomain. It would be possible to manipulate its own DOM and emit alert()s and such, but the surrounding site would remain untouched. You may have to do this anyway, no matter which method(s) you choose

• Parsing the user's code using a white list of allowed functions. Awfully complex to do as well, because there are so many notations and variations to take care of.

• There are several methods to monitor the DOM for changes, and I'm pretty sure it's possible to build a mechanism that reverts any changes immediately, quite similar to Windows's DLL management. But it's going to be awfully complex to build and very resource-intensive.

Answer 3

You can do it the same way as Facebook did. They're preprocessing all the javascript sources, adding a prefix to all the names other than their own wrapper APIs'.

Answer 4

Not really. JavaScript is an extremely dynamic language with many hidden or browser-specific features that can be used to break out of any kind of jail you can devise.

Don't try to take this on yourself. Consider using an existing ‘mini-JS-like-language’ project such as Caja.

Answer 5

I got another way: use google gears WorkerPool api
See this
http://code.google.com/apis/gears/api_workerpool.html

A created worker does not have access to the DOM; objects like document and window exist only on the main page. This is a consequence of workers not sharing any execution state. However, workers do have access to all JavaScript built-in functions. Most Gears methods can also be used, through a global variable that is automatically defined: google.gears.factory. (One exception is the LocalServer file submitter, which requires the DOM.) For other functionality, created workers can ask the main page to carry out requests.