Javascript restricts?

Question

Is it possible to limit javascript libraries to the ability to manipulate dom?

im trying to create a system that has a main system with api that can manipulate dom, and then I want to give the opportunity to create third-party scripts, but limit them to api functions only.

Answer 1

I would recommend you see the Google Caja project.

Caja allows websites to securely embed widgets and any web content from third parties using the "object security model" to provide a wide range of flexible security policies.

Answer 2

Not. The global context is the window object, and the window property is document . DOM methods are available from document . Anywhere, anyone can use window .

Answer 3

I don’t believe that. You could make it difficult (security through an obscure kind of nonsense), but not impossible.

Answer 4

You can override some basic JavaScript functions that redirect all calls to DOM manipulations to your infrastructure. For example, you can override document.getElementById or setAttribute and appendChild. You can even override them as empty functions. However, this is really not a good practice.