Skip to main content
Code Review

Return to Question

added 12 characters in body
Source Link
Nightfall
Nightfall
  • 3
  • 4

I am making a sandbox environment for javascript. For this I create a webworker with this function:

(self is a webworkers global context)

(() => {
   Function("\"use strict\";\nlet self,fetch;fetch,globalThis;(async()=>{try{"+arbitrary_code+"}}catch{})").apply({});
   return;
})();

With this, people are only able to use vanilla javascript with no access to any browser api's. Is there any way to defeat this sandbox, is it secure enough?

I am making a sandbox environment for javascript. For this I create a webworker with this function:

(self is a webworkers global context)

(() => {
   Function("\"use strict\";\nlet self,fetch;(async()=>{try{"+arbitrary_code+"}}catch{})").apply({});
   return;
})();

With this, people are only able to use vanilla javascript with no access to any browser api's. Is there any way to defeat this sandbox, is it secure enough?

I am making a sandbox environment for javascript. For this I create a webworker with this function:

(self is a webworkers global context)

(() => {
   Function("\"use strict\";\nlet self,fetch,globalThis;(async()=>{try{"+arbitrary_code+"}}catch{})").apply({});
   return;
})();

With this, people are only able to use vanilla javascript with no access to any browser api's. Is there any way to defeat this sandbox, is it secure enough?

Source Link
Nightfall
Nightfall
  • 3
  • 4

Is this a watertight javascript sandbox?

I am making a sandbox environment for javascript. For this I create a webworker with this function:

(self is a webworkers global context)

(() => {
   Function("\"use strict\";\nlet self,fetch;(async()=>{try{"+arbitrary_code+"}}catch{})").apply({});
   return;
})();

With this, people are only able to use vanilla javascript with no access to any browser api's. Is there any way to defeat this sandbox, is it secure enough?