Javascript input whitelist

I need to execute javascript code written by users. Of course, I have to consider javascript evil. I have a global object on the page that scripts should interact with, but I am not a wan script to be able to access anything else, including the DOM, jQuery and the window object.

Is it possible to modify the incoming javascript to cut out everything that I did not specify explicitly white?

For instance:

function modField(){
  if(!f.alpha.enabled){
    f.main.enabled = /960/.test(f.productName.text);
    f.name = document.getElementById('#username');
  }

}

Would after cleaning:

function modField(){
  if(!f.alpha.enabled){
    f.main.enabled = /960/.test(f.productName.text);
  }

}

How to do it?

+4
source share

Source: https://habr.com/ru/post/1660972/


All Articles