Alcatraz is high-security prison for your application code. It does this by wrapping your front-end code in an extra closure that can terminate hostile scripts by nuking global variables or introducing them in to the local scope and there for overriding them.
The primary objective of this module was to ensure that code can run safely
iframe element in the browser without requiring any code rewriting.
To see it's use for iframe sandboxing, please take a look at:
Current alcatraz does:
- set the
- try to remove references to iframe parents.
- add error listeners.
- prevent alert, prompt, confirm and other blocking dialogs
- add a
- add load listeners
- communicate the load, errors and console usage with an assigned method.
- Add a ping/pong method to help with figuring out blocking code.
To create a new prison for your code you need to require the
var Alcatraz = ;
Alcatraz constructor allows 3 arguments:
methoda string of the global function name that is used to communicate with the jail.
sourcethe actual code that needs to be locked down, this assumes a string.
domainthis sets the
document.domainto allow cross domain communication if needed. If no argument is give, it defaults to the current
To sandbox the code simply
toString your alcatraz instance.
var prison = 'myglobalfn' fs;console;
The wrapped code communicates with the given method using a simple object based protocol.