And here's code implementing a live console in your browser to play with: A little tcl.js console
Tcl may not be your cup of tea but the implementation looks fairly simple straightforward. This is mainly because tcl itself is such a simple language. You can use it to get ideas on how to implement variables and functions.
Hint: in tcl, control structures are functions so look at where built-in functions are implemented to see the implementation of for, while and foreach.
由于 JSLint 是一个 JavaScript 程序，因此它可以完全在 Web 浏览器中验证用户脚本。这与用 Java 编写的 Google Caja 形成鲜明对比。
Douglas Crockford's ADsafe is supposed to be a secure subset of JavaScript.
It consists of a runtime library (~20 KB minified) and a verifier (included in JSLint). If Crockford were to drop "The Software shall be used for Good, not Evil" from the license, both components would be GPL-compatible open-source programs.
Because JSLint is a JavaScript program, it can verify user scripts entirely within the web browser. This is in contrast to Google Caja, which is written in Java.
You could just sandbox; that is, scope in a couple of key variables so that the user's code is unable to access unsafe objects.
var execSandboxedJS = function (jsCode) {
var window = document.getElementById('myRootElement');
var document = window;
eval(jsCode);
};
Though, allowing user code to make ajax requests is, in itself, inherently unsafe. I would reconsider the sanity of the project if that's what's called for.
发布评论
评论（3）
下面是 Tcl 在 javascript 中的实现：Tcl in Javascript。
来源如下：tcl.js。
下面是在浏览器中实现实时控制台的代码： 一点 tcl.js 控制台
Tcl 可以不是你喜欢的，但实现看起来相当简单直接。这主要是因为tcl本身就是一种如此简单的语言。您可以使用它来了解如何实现变量和函数。
提示：在 tcl 中，控制结构是函数，因此请查看内置函数的实现位置，以了解 for、while 和 foreach 的实现。
Here's an implementation of Tcl in javascript: Tcl in Javascript.
Here's the source: tcl.js.
And here's code implementing a live console in your browser to play with: A little tcl.js console
Tcl may not be your cup of tea but the implementation looks fairly simple straightforward. This is mainly because tcl itself is such a simple language. You can use it to get ideas on how to implement variables and functions.
Hint: in tcl, control structures are functions so look at where built-in functions are implemented to see the implementation of for, while and foreach.
Douglas Crockford 的 ADsafe 应该是 JavaScript 的安全子集。
它由一个运行时库（缩小后约 20 KB）和一个验证器（包含在 JSLint 中）组成。如果 Crockford 从许可证中删除“该软件应用于善良，而非邪恶”，则这两个组件都将是 GPL 兼容的开源程序。
由于 JSLint 是一个 JavaScript 程序，因此它可以完全在 Web 浏览器中验证用户脚本。这与用 Java 编写的 Google Caja 形成鲜明对比。
Douglas Crockford's ADsafe is supposed to be a secure subset of JavaScript.
It consists of a runtime library (~20 KB minified) and a verifier (included in JSLint). If Crockford were to drop "The Software shall be used for Good, not Evil" from the license, both components would be GPL-compatible open-source programs.
Because JSLint is a JavaScript program, it can verify user scripts entirely within the web browser. This is in contrast to Google Caja, which is written in Java.
你可以只是沙箱；也就是说，将范围限制在几个关键变量中，以便用户的代码无法访问不安全的对象。
不过，允许用户代码发出 ajax 请求本身本质上是不安全的。如果需要的话，我会重新考虑该项目的合理性。
You could just sandbox; that is, scope in a couple of key variables so that the user's code is unable to access unsafe objects.
Though, allowing user code to make ajax requests is, in itself, inherently unsafe. I would reconsider the sanity of the project if that's what's called for.