I need to execute javascript code written by users. Of course, I have to consider javascript evil. I have a global object on the page that scripts should interact with, but I am not a wan script to be able to access anything else, including the DOM, jQuery and the window object.
Is it possible to modify the incoming javascript to cut out everything that I did not specify explicitly white?
For instance:
function modField(){
if(!f.alpha.enabled){
f.main.enabled = /960/.test(f.productName.text);
f.name = document.getElementById('#username');
}
}
Would after cleaning:
function modField(){
if(!f.alpha.enabled){
f.main.enabled = /960/.test(f.productName.text);
}
}
How to do it?
source
share