0

I trying to create a sandbox module that can take a object and prevent that object's code reference to window.

here is how it work in concept. 

var sand = function(window) {
var module = {
    say: function() {
        console.log(window.location);
    }   
};
return module;
}
sand({}).say(); // window.location is undefine

This doesn't work if the object is pass-in

var $sand = (function(){
return function(obj, context) {
    return (function(obj, window) {
        window.module = {};
        // doesn't work even copy object
        for (p in obj) {
            window.module[p] = obj[p];
        }
        console.log(window.location); // undefine
        return window.module;
    }(obj, context));
};
}());

var module = {
say: function() {
    console.log(window.location);
}
};

$sand(module, {}).say(); // still reference to window.location

How can i make this pattern work?

adam ac
  • 97
  • 1
  • 2
  • I am a little unclear, do you mean you want:`var sand = function(window) { var module = { say: function() { alert(typeof window.location); } }; return module; } sand(undefined).say();` which would make "window" not a defined object inside? In other words, this returns "true" `alert(null ==window);` – Mark Schultheiss Apr 19 '12 at 14:52
  • Bad news: FORGET IT. Preventing access to the global object is *impossible* - "shadowing" the name is not sufficient. – Mörre Apr 19 '12 at 15:14

3 Answers3

1

As long as you don't have a variable shadowing window in the scope of your function, the function will be able to access window. Even if you had a variable called window, the code will still be able to access the properties by simply omitting window..

(function(window) {
    console.log(window.location); //undefined
    console.log(location); //this will still work
})({ });

In other words, sandboxing JavaScript in a browser environment is not possible like this.

Jani Hartikainen
  • 42,745
  • 10
  • 68
  • 86
1

In your first example, the only reason window is undefined is because you are passing in an empty object and calling the argument window, so it is hiding the real window.

Also, you can always get access to the window object by hoisting the this variable inside a closure, like so:

console.log ( ( function () { return this; } )() );

So even if you somehow manage to block window, it's trivial to get it back again.

beeglebug
  • 3,522
  • 1
  • 23
  • 39
0

If you define the function outside your sandbox, the context will be the current one, and you can't really do otherwise.

If you really want to do some sandboxing, then you should use iframes to achieve that. Take a look at https://github.com/substack/vm-browserify it is a browser version of the vm module of node, you should be able to extract some good pieces of work, and avoiding eval which is not really clean for what you want to do.

Tronix117
  • 1,985
  • 14
  • 19
  • thanks for all the answer. I found Dean Edward had done this since 2006... http://dean.edwards.name/weblog/2006/11/sandbox/ – adam ac May 31 '12 at 14:21