4 ms·

You can run untrusted code in an iframe (possibly with the sandbox attribute set). I think this would be what you're looking for.

• dbpokorny 11y ago
  Go to http://www.html5rocks.com/static/demos/evalbox/index.html http://www.html5rocks.com/static/demos/evalbox/index.html type in console.log("foo") and click either button. It has access to the console even from the sandbox. Is there a way to say: I want this iframe to run a script, but don't give the script access to the console?
  • luhn 11y ago
    That seems a contrived example. The console is invisible to the end-user, why does it matter if an application can output to it?
  • lambdapie 11y ago
    No, but I'd still recommend looking into content security policy (CSP), iframes, and the sandboxed attribute. Even though you seem to have developed your own notion of what isolation/security should look like, the HTML spec authors have thought very carefully about this and CSP has its own internal logic. Even if you still prefer your model, at least you will be able to explain how your model differs from CSP and why it's better.