JavaScript 沙箱
我想让开发人员用 Javascript 为网站编写一些自定义应用程序，但我想将其沙箱化，这样他们就不能做任何顽皮的事情，例如重定向用户、将正文显示设置为无等。我在 Javascript 中有一个命名空间，其中所有他们需要的功能都存在在那里，所以我认为创建一个沙箱将是一个问题：
with(Namespace) {
//App code goes here where they can only access Namespace.*
}
绕过这个问题有多容易，以及还有哪些其他方法可以完成？宁愿不必审核每个提交的应用程序。
I want to have developers write some custom apps for a site in Javascript but I want to sandbox it so they can't do anything naughty like redirect the user, set the body display to none etc etc. I have a namespace in Javascript where all the functions they'll ever need exist in there so I was thinking to create a sandbox would be a matter of:
with(Namespace) {
//App code goes here where they can only access Namespace.*
}
How is easy is it to get around this and what other methods can be done? Would rather not have to moderate every submitted app.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
目前沙箱代码的选项有：
两者都允许您创建一个安全环境，其中对全局对象和 DOM 的访问受到限制。
这些项目的主要目的是允许您安全地嵌入来自第三方的小部件和任何 Web 内容。
Well, the options to sandbox code at the moment are:
Both allow you to create a safe environment where the access to the global object and the DOM is restricted.
The primary purpose of these projects is to allow you to safely embed widgets and any web content from third parties.
我首先想到的是
eval。他们可以使用它在包装器沙箱之外执行自定义代码。很难通过尝试包装代码来阻止坚定的开发人员。链接到 eval 的使用。
The first thing that comes to mind is
eval. They can use that to execute custom code outside of the wrapper sandbox. It will be very hard to stop a determined developer by attempting to wrap the code.Link to the use of eval.
要强制执行沙箱，您必须在执行代码之前检查代码，捕获任何非法代码，如果发现，以某种方式阻止它运行。时间长了非常繁琐而且容易出错。
Facebook 至少在他们早期的平台上是这样做的，作为一名开发者，我绝对不喜欢它。他们限制了可以使用的本机方法，并为某些方法提供了有限的包装器。
To enforce a sandbox, you would have to inspect the code before it is executed, capture any non-legit code and if found, somehow prevent it from running. Very tedious and prone for errors for a long time.
Facebook did this at least in their early platform, I, as a developer, definitely did not enjoy it. They limited the native methods that could be used, and provided limited wrappers around some.