Prevent access to document.write from ProcessingJS environment

[pamelafox]

Some students are using document.write to use HTML in PJS:

mousePressed = function(){
    (function(){
        return this[["document"][0]];
    })().write("<button>Button.</button><a href='http://www.w3schools.com/'><p>Button</p>");
};

I'm not too concerned from a security perspective thanks to our use of Content-Security-Policy with the editor on Khan Academy, but I don't like it when a kludgy looking hack like this becomes common-place in code, and it makes the learning experience harder for new students.

[pamelafox]

Related way to get access to DOM:

var img = getImage("cute/None"); 
var body = img.sourceImg.parentNode.parentNode;

[bytorbrynden]

...you can also access the DOM using something like follows:

var snd = getSound("rpg/battle-magic");

// In this example, I'm just printing the properties from the HTMLAudioElement
for (var i in snd.audio) {
    println(i);
}

[falsidge]

This could be used to inject code into the main page by sending errors with scripts. https://www.khanacademy.org/computer-programming/teste/4939494021791744

[bytorbrynden]

...the following can also be used to invoke document.write (or any Javascript function, really):

var a = (function() {
    return this.Function("document.write('Hello, world!')");
})();

a();

[bytorbrynden]

@falsidge Interesting approach... Using a bit of jQuery and that approach, students can make programs that automatically click the vote up button.

For example, pass the following into topexec:

$(".vote-up a").attr("href", "").trigger("click")

Then refresh the page. Voila.

[SharkFinPro]

I am not sure if this is related, but i have found a way to access a computers camera. https://www.khanacademy.org/computer-programming/camera/4984174539 I have put it there