Question

Is it possible for a visitor to a page to run an arbitrary function specified in the javascript for that page from their browser?

For a simple example, if the page has a function to hide a particular element when a button is clicked, can a visitor trigger that function and hide the element without clicking the button, but by calling the function directly somehow?

Answer 1

Yes, the user has full control of the DOM. However, it is possible to reduce what can be accessed by using closures. For instance, if I have:

(function() {
    var myvar = "can't touch me!";
    // do stuff with myvar
})();

Then there is no way for the user to get at or change the string. Similarly for functions, unless you make them global variables (or attach them to the window object). Any property attached to the DOM is accessible too, such as the onclick attribute of elements. However if you use the addEventListener method then I don’t think there’s any way to find it.

Overall, the browser can’t be trusted.