How to run javascript code from string in safe way

Question

I found some answers, but very old one and I wondered how can it be done?

I've seen that eval() function isn't safe:

Alternate for eval() to execute auto-generated JS code from the server

So what are my options in order to run a javascript code in isolated secured way?

If it was totally isolated, you wouldn't need to run it. What is the problem you are trying to solve? — Bergi
– Bergi, Commented May 30, 2020 at 21:02
@Bergi I want to build an app that allow you to share code and execute it. — Dorki
– Dorki, Commented May 30, 2020 at 21:03
@Dorki Users running code that is shared by other users is inherently unsafe. Don't do that. If you take a look at how all the code sharing platforms work (including things like StackSnippets): they serve the code on a separate domain and sandbox it in an iframe protected by the SOP. — Bergi
– Bergi, Commented May 30, 2020 at 21:04
See stackoverflow.com/q/10653809/1048572 stackoverflow.com/q/22506026/1048572 stackoverflow.com/q/195149/1048572 stackoverflow.com/q/2986908/1048572 stackoverflow.com/q/5044608/1048572 — Bergi
– Bergi, Commented May 30, 2020 at 21:15

Luca Fabbian · Accepted Answer · 2020-05-30 21:36:48Z

(as pointed out, this answer is outdated and the proposed solution could be easily broken).

Currently, draft for secure ecmascript has not been approved/implemented yet. One hack that has decent browser support (proxy is es6 feature) is using proxies and with to create a sandbox.

You just have to write a proxy which returns null for every requested key except for some safe functions. with would ask the proxy every time a var outside eval is required (for example, window) and so, provide null instead of the real var.

Check this website for a tutorial: code sandbox

why? I could not find an example that breaks it - moreover I've seen it used in a commercial solution by a big tech company. Of course, it's an hack - not a true solution (iframes are too).
no, you can bind "this" to another var (JavaScript perfectly allows it).
No, this is a reserved word. You can't name a variable after it.

Collectives™ on Stack Overflow

How to run javascript code from string in safe way

1 Answer 1

7 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

7 Comments

Linked

Related