Hacker News Reader

Comment by novaleaf | Hacker News Reader

Does anyone know a good sandboxing technology to execute user written javascript in a safe way? (like, on other user machines or on the server)? I have some ideas like "learn programming" that would benefit from this immensely.

View on HN

Niel Fraser, the guy who created the Blockly block programming toolkit also created a JS Interpreter which allows single stepping of code. https://neil.fraser.name/software/JS-Interpreter/docs.html

I've hacked on this interpreter some, it's pretty nice to read! It implements a very limited subset of JavaScript, something like ES3.

I'd be really interested to hear about other similar implementations of JavaScript in JavaScript. I stopped working on https://github.com/thomasballinger/hotswapping-js-interp#js-... partially because copying the state of the interpreter was relatively slow. I'd be interested in implementations that would handle this better by using a more bytecode-like VM or immutable data structures.

wow! this is really awesome and perfect for my needs. thanks very much :)

https://developers.google.com/caja/

Used it a few years ago. It was a little finnicky to get working right but I was impressed at the time. No idea where the project is at nowadays.

i saw caja, but it looks really complex, was hoping for something better these days :(

Note that caja doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (`while(true){}`). This may or may not be a problem depending on your use-case. (If you're using caja for code written by mostly-trusted 3rd parties, or for one user's code only on their own machine, then it's not much of an issue. If you're serving code written by one user to another, then it could be a problem.)

Ha, here's an old thread where I asked the caja developers about that exact scenario: https://groups.google.com/forum/#!topic/google-caja-discuss/...

Some possible mitigations but I don't know if they ever implemented them.

The safest way would be to embed an interpreter written in JS and remove any sort of I/O or FFI capability from the interpreter.

What about Node.js's `vm` module?

thanks, I didn't actually know about that. it looks like a perfect (and simple) solution for running on nodejs. wish there was something like that for browsers too!

edit: i guess there is this: https://github.com/substack/vm-browserify

Note that the vm module doesn't protect against local denial-of-service attacks: user-written javascript executed with it could allocate tons of memory or run forever (despite any configured timeouts: https://github.com/nodejs/node/issues/3020).

Reply on news.ycombinator.com