Javascript沙盒 [英] Javascript Sandbox

问题描述

我希望让开发人员在Javascript中为网站编写一些自定义应用程序，但我想要沙箱，这样他们就无法做任何顽皮的事情，例如重定向用户，将正文显示设置为无等等。我有一个命名空间Javascript，其中所有需要的功能都存在于那里，所以我想创建一个沙箱将是一个问题：

I want to have developers write some custom apps for a site in Javascript but I want to sandbox it so they can't do anything naughty like redirect the user, set the body display to none etc etc. I have a namespace in Javascript where all the functions they'll ever need exist in there so I was thinking to create a sandbox would be a matter of:

with(Namespace) {
    //App code goes here where they can only access Namespace.*
}

如何轻松解决这个问题以及可以采取哪些其他方法？宁愿不必审核每个提交的应用程序。

How is easy is it to get around this and what other methods can be done? Would rather not have to moderate every submitted app.

推荐答案

要强制执行沙箱，您必须先检查代码。执行，捕获任何非合法的代码，如果找到，以某种方式阻止它运行。非常繁琐且长时间容易出错。

To enforce a sandbox, you would have to inspect the code before it is executed, capture any non-legit code and if found, somehow prevent it from running. Very tedious and prone for errors for a long time.

Facebook至少在他们的早期平台上做到了这一点，作为开发者，我绝对不喜欢它。它们限制了可以使用的本机方法，并为某些方法提供了有限的包装。

Facebook did this at least in their early platform, I, as a developer, definitely did not enjoy it. They limited the native methods that could be used, and provided limited wrappers around some.

这篇关于Javascript沙盒的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！