Question

I have been to some css/html/js discussing board which provide a text box to enter the html and a “Run it!” button to run the html in new pops up window.

I want to make one also, which is easy in jQuery:

function try_show_result() {
  var code = $("#try-input").val();
  if (code !== "") {
    var newwin = window.open('','','');
    newwin.opener = null; // 防止代ç 修改主页
    newwin.document.write(code);
    newwin.document.close();
  }
}

But then I found a security problem: the pops up window has all the abilities of running an arbitrary javascript. So that when another authenticated user runs a given piece of code on the page, then it could stealing cookies or access some url that is only for the specified user only through ajax posts.

Is there an easy way to avoid this?

Update: I added newwin.document.cookie=”” before open the window, not sure if this is better.

Answer 1

Is there an easy way to avoid this?

No

That is why Facebook went out and wrote their own version of JavaScript [FBJS].