4 ms·
Javascript is too dynamic to have a safe subset. For example, using only the six characters ()+ []! you can write arbitrary code. The main culprits are the weak
by BoppreH 9y ago
Javascript is too dynamic to have a safe subset. For example, using only the six characters ()+
[]! you can write arbitrary code. The main culprits are the weak typing, permissive attribute access, and large runtime environment with lots of surface area. This is unlikely to be fixable by changing the language grammar.
See http://www.jsfuck.com/ http://www.jsfuck.com/
JSFuck is an esoteric and educational programming style
based on the atomic parts of JavaScript. It uses only six
different characters to write and execute code.
It does not depend on a browser, so you can even run it on
Node.js.
- pdubroy 9y agoDepending on your definition of "safe", it is indeed possible. See the paper "Preventing Capability Leaks in Secure JavaScript Subsets" for a good analysis: http://www.adambarth.com/papers/2010/finifter-weinberger-barth.pdf http://www.adambarth.com/papers/2010/finifter-weinberger-bar...
- Sophistifunk 9y agoIf you simply hand your subset off to the standard runtime yes, but you needn't do that. Once you've parsed it, you could certainly close those doors with a few simple rewrite rules.