asvd / jailed

execute untrusted code with custom permissions
MIT License
1.01k stars 69 forks source link

Browserify-support #16

Open codeclown opened 8 years ago

codeclown commented 8 years ago

I would love to use this library but I'm using Browserify, which isn't supported properly at the moment. I'm interested in creating a pull request for support, but in order to do that I would need to know a bit more about how the code functions.

When I tried it, it attempted loading the _JailedSite.js file using a script-tag. I assume this is done inside the iframe to allow access to it..? With Browserify this doesn't work because Browserify combines all code into one file, and that's the only file served publicly.

Would it be possible to do this without loading an extra file? Probably it would mean having _JailedSite.js return a function which will then be executed when the iframe loads.

As you can see, I'm clueless here so it would be great if you could briefly outline the way this script works and we could go from there.

asvd commented 8 years ago

There was a related discussion: https://github.com/asvd/jailed/issues/6

For now we came up with the following solution: bundle jailed.js into the application, put all other files shipped with jailed along with the bundle.

I'm going to play with bundling and proably figure out something more elegant later.

codeclown commented 8 years ago

Yeah, that should work. Being able to rely completely on Browserify would be great though, so if you can think of a way to avoid this solution, that'd be awesome.

asvd commented 8 years ago

The problem is that there is some code loaded by the worker, and if not keeping it in a separate file, I would have to keep it as a string inside the main code, which is not very convenient.

codeclown commented 8 years ago

Is it not possible to inject a simple script into the iframe, which will then call a function (doing what _JailedSite.js does) from the parent window (window.parent.jailedSiteCallback())?

asvd commented 8 years ago

The worker cannot access the code of the iframe. I can only send a message with a string, and then evaluate it on the opposite side.

Currently I keep as a string the minimal amount of code for the worker which is needed to setup the initial communication:

https://github.com/asvd/jailed/blob/master/lib/_frame.js#L29

Then it loads _pluginWebWorker.js and sets up itself.

andrey-skl commented 8 years ago

So I did implement such feature in my fork as well as some other improves like promises support. You may not want to just merge it but you can check my build process and may be reuse something from it https://github.com/huston007/jailed. I did some code duplicates in built codebase and I see that, but code size is still pretty small.

Immortalin commented 6 years ago

@asvd do you think you can add browserify support? Bundling is getting increasingly common and shipping it by the side feels like a hack