I am looking at allowing users to enter JavaScript to specify some logic in my app. The JavaScript would be entered and displayed in a browser, but it would be saved and validated server-side first.
This opens up obvious security implications.
Ideally, I would want to only allow a subset of the JavaScript language. Intuitively, an opt-in approach – specifying what is allowed, and disallowing everything else – seems more secure than an opt-out approach – specifying what is disallowed.
A lot of the solutions I’ve seen are client-side – I think a server-side solution makes more sense for my needs, since I can give feedback to the user if the JavaScript is invalid, and only save it on the server once it’s “clean”.
It would also be useful to put in place something to parse the JavaScript and perform some checks – for example, I would provide some variables to the user, I would want to check that they’re not using any uninitialized variables, or that the code returns something in an expected format. A sandbox solution should at the very least not hinder this, but it could potentially actively help – if it works by parsing the code and not just regexps, and I can put my own hooks in to check some syntax.
Google Caja looks like it might do what I want, but I haven’t dived into it very much.
What approach would you recommend?
Open-source solutions are great. I don’t mind writing my own code, but this seems like a non-trivial problem to solve properly from scratch.
If you don’t mind leaving out browsers that don’t support web worker threads, you can try JSandbox, which effectively sandboxes execution of JavaScript in “sandbox” worker threads.