Sandboxing Javascript code

Question

I am working on a game in Javascript, and I would like to be able to include a modding API. How can I allow a developer to execute arbitrary code using my API while keeping them from doing malicious activities (stealing cookies, redirecting to a malicious site)?

icktoofay · Accepted Answer · 2011-04-04 03:57:06Z

5

There's a project by Google that aims to allow you to do something like this.

answered Apr 4, 2011 at 3:57

icktoofay

130k23 gold badges261 silver badges239 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Winfield Trail · Accepted Answer · 2011-04-04 04:04:14Z

1

I'm working on something like this and my solution was to run the script-ables inside an iFrame that points to a subdomain (http://bar.foo.com) instead of the main site (http://foo.com). Input is provided to the script via url #fragment#identifiers and output is provided through the URL fragment identifier of a nested, invisible iFrame pointing back at the original name.

Remember, you can set a child frame's URL even if you can't see it, and you can always check a frame's specific URL if it's on the same domain.

answered Apr 4, 2011 at 4:04

Winfield Trail

5,7032 gold badges31 silver badges45 bronze badges

Collectives™ on Stack Overflow

Sandboxing Javascript code

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related