Protecting SSJS from Unverified Code

Question

I want to use node.js (or another SSJS solution) by running my own code + external written code inside (untrusted).

Any way to separate and protect your own code? Can I limit the modules and the system effect of untrusted code (restrict access to files, not HTTP ports, etc.)?

Answer 1

You can check out this project seems very promising:

http://github.com/gf3/node-sandbox

Personally, I do not use Node to perform arbitrary SSJS execution. You probably won't like this solution, but it worked perfectly for me for a year:

Perl API Spidermonkey (Spidermonkey - JS Firefox) . CGI. , (, Perl... blech) , . , . DOM.

, ( ), , , REST API . HMAC, . Perl script , script (script POST). Perl script . , - 10 .

, !

Answer 2

node.js

script.runInNewContext([])

Script.runInNewContext( capital 'S'), Script. Script.runInNewContext Script . . .

http://nodejs.org/api.html#script-runinnewcontext-105

Answer 3

Take a look at Caja . It translates third-party code into a form in which the code has only access to objects that you explicitly provide.