ansaurus

Question

Is it possible to "sandbox" arbitrary JavaScript to only operate on one <div> and not the whole document?

Answer 1

A:

This is from jQuery selectors documentation. Is that helpful?

<!DOCTYPE html>
    <html>
    <head>
      <script src="http://code.jquery.com/jquery-latest.min.js"&gt;&lt;/script&gt;
    </head>
    <body>
        <input name="man-news" />

      <input name="milkman" />
      <input name="letterman2" />
      <input name="newmilk" />
    <script>$("input[name*='man']").val("has man in it!");</script>
    </body>
    </html>

Gabriel 2010-07-23 16:50:08

This unfortunately is not helpful. The problem is the code I will be executing won't be my code actually. Someone might write some pure JavaScript malicious code. I need to be able to restrict any inputed executable string to some DOM area.

Dejw 2010-07-23 16:54:59

Answer 2

A:

By default, jQuery is based on the document element, but you can pass a second parameter that tells jQuery where to "start", which essentially limits the execution to that element...

var divToRestrictTo = $("#myDiv");
$("input", divToRestrictTo); // will only look within the DIV

Josh Stodola 2010-07-23 17:03:26

Yes, I know that, but how You possibly know the inputed code will use jQuery? and use it just how You describe it? I will say this again: I won't know the inputed code, this might be arbitrary, someone else's code.

Dejw 2010-07-23 17:06:25

Answer 3

+4 A:

The best way to achieve complete isolation and encapsulation of a chunk of code is to put it into an iframe, and put it on a subdomain of your site so that the domain name of the outer HTML page is not identical to the inner HTML page. Inside the iframe, the JavaScript will see only the DOM of the iframe URL and will have no access to the outer DOM. This isolation is enforced by the browser security model.

The plus side to this technique is that you can have high confidence that the script running inside the iframe will not leak out and steal data from your outer page. This isolation is also the downside - it's harder to share data between the outer page and inner page. To provide controlled access or sharing of data between the iframe and the outer page, there are a variety of cross-domain data sharing techniques you could investigate. If you only need to throw arguments "at" the iframe inner page, you could pass the data on the URL as query params. If you need two-way data exchange, you could use domain-lowering techniques to bring the domain names in line briefly so that the browser will allow data exchange between the outer and inner pages.

Since you are proposing to eval() arbitrary code entered in an input control, you definitely should shield your main page logic from potential hackery. Use an iframe.

dthorpe 2010-07-23 17:05:28

Executing code not necessarily mean `eval` for me. The code will come from other page, (eg. loaded by AJAX). If You ware forbidden to use iframe, what would You use instead?

Dejw 2010-07-23 17:22:19

If I were forbidden to use iframe to protect my web assets from arbitrary external code, I'd send a letter through postal mail instead. ;>The browser/HTML/DOM does provide a way to isolate untrusted JavaScript code from the rest of your site. It's called iframe.I don't know of any other way of achieving this isolation other than writing your own browser or native executable browser plugin.

dthorpe 2010-07-23 17:46:19

Thank You very much :)

Dejw 2010-07-23 17:51:28

ansaurus

tags:

views:

answers:

Is it possible to "sandbox" arbitrary JavaScript to only operate on one <div> and not the whole document?

related questions