asvd / jailed

execute untrusted code with custom permissions
MIT License
1.01k stars 69 forks source link

Basic example doesn't work #21

Open mgeduld opened 8 years ago

mgeduld commented 8 years ago

Sorry if this is due to a lack-of-understanding on my part, but I can't get this to work. I'm running it locally, and I've tried it in Chrome and Safari on Mac.

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <script src="jailed.js"></script>
</head>
<body>
    <div id="content"></div>
    <script>
        var api = {
            alert: alert
        };

        var pluginCode = "application.setInterface({\n";
        pluginCode += "foo: function() {\n";
        pluginCode += " application.remote.alert('hi');\n";
        pluginCode += "}});"

        console.log(pluginCode);

        var plugin = new jailed.Plugin(pluginCode, api);

        plugin.remote.foo();
    </script>
<body>
</html>
asvd commented 8 years ago

And what happens then? Is there some error message on the console?

mgeduld commented 8 years ago

Sorry. I should have specified. I get this Error message: Uncaught TypeError: Cannot read property 'foo' of null

And when I dump plugin into the console, remote's value is null.

asvd commented 8 years ago

I see, the plugin takes some time to initialize and it happens asynchronously. When you just created the Plugin instance with new jailed.Plugin(pluginCode, api);, the connection to the plugin is not yet ready at the same moment, so you cannot simply invoke plugin.remote.foo() right after creation.

Instead, use the whenConnected() one-off event to postpone the usage upon the plugin initialization. This can be achieved by replacing your last line of code with something like:

var start = function() {
    plugin.remote.foo();
}

plugin.whenConnected(start);
mgeduld commented 8 years ago

That make sense, but this still doesn't work. The error is gone, but I neither get an alert nor the "started" message in the console.

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <script src="jailed.js"></script>
</head>
<body>
    <div id="content"></div>
    <script>
        var api = {
            alert: alert
        };

        var pluginCode = "application.setInterface({\n";
        pluginCode += "foo: function() {\n";
        pluginCode += " application.remote.alert('hi');\n";
        pluginCode += "}});"

        console.log(pluginCode);

        var plugin = new jailed.Plugin(pluginCode, api);

        plugin.whenConnected(function() {
            console.log('started');
            plugin.remote.foo();
        });
    </script>
<body>
</html>
asvd commented 8 years ago
  1. which version of jailed do you use? (from the release, or from the repo?)
  2. Does it work if launched from a web-server, and not locally? (I am not sure if it should work locally at all...)
mgeduld commented 8 years ago

I used 0.2.0.

I haven't tried it from a server. The documentation made it seem as if it could work as a client-only app, but maybe I misunderstood it.

asvd commented 8 years ago

It is indeed a client-only app, but there are some security restricitons of the browser arising when you launch it from a local filesystem. It should (in theory) work locally as well, otherwise there is a bug. Can you please try to use the recent sources from the repository, in order to see if the problem is not yet fixed?

mgeduld commented 8 years ago

The latest version still says it's 0.2.0. Did you make changes without bumping the number?

mgeduld commented 8 years ago

I just downloaded the distribution again and tried it on a different Mac. It doesn't work in Chrome, and no errors appear in the console.

It also doesn't work in Safari, but I see this: [Error] SyntaxError: DOM Exception 12: An invalid or illegal string was specified. (_pluginWeb.js, line 50)

mgeduld commented 8 years ago

Firefox: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing. index.html The character encoding of a framed document was not declared. The document may appear different if viewed without the document framing it.

asvd commented 8 years ago

The latest version still says it's 0.2.0. Did you make changes without bumping the number?

Yep, this is what I ment. There are a lot of changes committed to the repo but not yet released. Please go here: https://github.com/asvd/jailed and click "Download zip" button, you will get the fresh sources.

mgeduld commented 8 years ago

I did that and got the above errors.

asvd commented 8 years ago

Another issue in your code: if you initialize a plugin out of a string, it should be DynamicPlugin, not a Plugin (which is used when code is stored in a file). Your example works for me locally with such a fix.

aminroosta commented 7 years ago

@asvd Even with DynamicPlugin i get Cannot read property 'foo' of null.

mp31415 commented 7 years ago

It may be obvious but in addition to jailed.js all other files from lib folder must be also available. If these files are around the basic example works.