Prevent DOM access (i.e. XHR and such)
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 20/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- javascript
- Domain
- security
Research direction
Start with the sandboxing discussion and evel.js around line 49, along with the iframe.contentWindow.eval approach cited in the issue. The payload names no vm-browserify file, test, or complete acceptance condition, so the intended DOM/XHR restrictions would need to be defined before implementation.
Written by the indexing model from the issue text.
Description
Just spent today working on a sandboxing thing from a different angle before I found this. Turns out it's actually somewhat complementary!
- The
iframe.contentWindow.evaltrick does a great job preventing an untrusted script from messing with other people's object prototypes. - Combining
"use strict";with a silly closure trick it seems possible to prevent access to all global objects…except object literal prototypes!
You can take a look at what I got on this in https://github.com/natevw/evel/blob/master/evel.js#L49 — I do whitelist the ES5 globals because I assume most code should be allowed to expect them. I'll be the first to admit that masking every global every function call is kind of "not ideal" but AFAICT combining https://github.com/natevw/evel's tricks with this iframe stuff yields a fairly declawed environment.
- Dominant language
- JavaScript
- Stars
- 205
- Forks
- 41
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from browserify/vm-browserify
-
Difficulty 1/5 Under an hour Newbie friendliness 20/100
browserify/vm-browserify#31 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 25/100
browserify/vm-browserify#30 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
browserify/vm-browserify#25 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
browserify/vm-browserify#24 · 10 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
browserify/vm-browserify#23 · 3 comments ·
All issues in browserify/vm-browserify
Similar issues
-
bot:ai-assisted component:compact-js status:untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
midnightntwrk/midnight-sdk#403 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 86/100
DavidAnson/markdownlint-cli2#940 ·
-
documentation
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
githubnext/gh-aw-workshop#3692 ·
-
agent/guide documentation hive/hosted-available-lke648397-260827-5n31
Difficulty 2/5 1-3 hours Newbie friendliness 90/100