You're Invited:Meet the Socket Team at BlackHat and DEF CON in Las Vegas, Aug 7-8.RSVP
Socket
Socket
Sign inDemoInstall

alcatraz

Package Overview
Dependencies
0
Maintainers
1
Versions
2
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

alcatraz

A high-security prison for your application code


Version published
Maintainers
1
Created

Readme

Source

Alcatraz

Build Status

Alcatraz is high-security prison for your application code. It does this by wrapping your front-end code in an extra closure that can terminate hostile scripts by nuking global variables or introducing them in to the local scope and there for overriding them.

The primary objective of this module was to ensure that code can run safely within an iframe element in the browser without requiring any code rewriting. To see it's use for iframe sandboxing, please take a look at:

https://github.com/3rd-Eden/containerization

Current alcatraz does:

  • set the document.domain.
  • try to remove references to iframe parents.
  • add error listeners.
  • prevent alert, prompt, confirm and other blocking dialogs
  • add a console object
  • add load listeners
  • communicate the load, errors and console usage with an assigned method.
  • Add a ping/pong method to help with figuring out blocking code.

Getting started

To create a new prison for your code you need to require the alcatraz module.

var Alcatraz = require('alcatraz');

The Alcatraz constructor allows 3 arguments:

  1. method a string of the global function name that is used to communicate with the jail.
  2. source the actual code that needs to be locked down, this assumes a string.
  3. domain this sets the document.domain to allow cross domain communication if needed. If no argument is give, it defaults to the current document.domain.

To sandbox the code simply toString your alcatraz instance.

var prison = new Alcatraz('myglobalfn', fs.readFileSync('index.js', 'utf-8'));

console.log(prison.toString());

Protocol

The wrapped code communicates with the given method using a simple object based protocol.

{ type: ping }                // send a ping packet
{ type: load }                // the load event fired
{ type: error }               // critical javascript error
  { scope: 'window.onerror' } // the error has a scope, to trace back the origin
  { args: [] }                // the arguments the error received
{ type: console }             // console method was accessed
  { attach: boolean }         // was a logging/debuggin method
  { scope: method }           // method name used
  { args: [] }                // arguments of the console

License

MIT

Keywords

FAQs

Package last updated on 03 Jan 2014

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc