Does anyone know a good sandboxing technology to execute user written javascript in a safe way? (like, on other user machines or on the server)? I have some ideas like "learn programming" that would benefit from this immensely.
I've hacked on this interpreter some, it's pretty nice to read! It implements a very limited subset of JavaScript, something like ES3.
I'd be really interested to hear about other similar implementations of JavaScript in JavaScript. I stopped working on https://github.com/thomasballinger/hotswapping-js-interp#js-... partially because copying the state of the interpreter was relatively slow. I'd be interested in implementations that would handle this better by using a more bytecode-like VM or immutable data structures.
Note that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)
Note that the vm module doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (despite any configured timeouts: https://github.com/nodejs/node/issues/3020).
thanks, I didn't actually know about that. it looks like a perfect (and simple) solution for running on nodejs. wish there was something like that for browsers too!
Comments
Does anyone know a good sandboxing technology to execute user written javascript in a safe way? (like, on other user machines or on the server)? I have some ideas like "learn programming" that would benefit from this immensely.
Niel Fraser, the guy who created the Blockly block programming toolkit also created a JS Interpreter which allows single stepping of code. https://neil.fraser.name/software/JS-Interpreter/docs.html
I've hacked on this interpreter some, it's pretty nice to read! It implements a very limited subset of JavaScript, something like ES3.
I'd be really interested to hear about other similar implementations of JavaScript in JavaScript. I stopped working on https://github.com/thomasballinger/hotswapping-js-interp#js-... partially because copying the state of the interpreter was relatively slow. I'd be interested in implementations that would handle this better by using a more bytecode-like VM or immutable data structures.
wow! this is really awesome and perfect for my needs. thanks very much :)
https://developers.google.com/caja/
Used it a few years ago. It was a little finnicky to get working right but I was impressed at the time. No idea where the project is at nowadays.
Note that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)
Ha, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/...
Some possible mitigations but I don't know if they ever implemented them.
i saw caja, but it looks really complex, was hoping for something better these days :(
The safest way would be to embed an interpreter written in JS and remove any sort of I/O or FFI capability from the interpreter.
What about Node.js's `vm` module?
Note that the vm module doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (despite any configured timeouts: https://github.com/nodejs/node/issues/3020).
thanks, I didn't actually know about that. it looks like a perfect (and simple) solution for running on nodejs. wish there was something like that for browsers too!
edit: i guess there is this: https://github.com/substack/vm-browserify