Security News
The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
workerboxjs
Advanced tools
A secure sandbox to execute untrusted user JavaScript, in a web browser, without any risk to your own domain/site/page.
A secure sandbox to execute untrusted user JavaScript, in a web browser, without any risk to your own domain/site/page.
To ensure the untrusted code can not access any data, permissions, that have been given to your site, it's important the evaluator is run on a domain completely separate from your own site.
The separate domain code is located in the ./server
folder of this repo. You can host it yourself, but make sure it's on another domain, or feel free to use the default one for free at https://workerbox.net/.
npm install --save workerboxjs
import createWorkerBox from 'workerboxjs';
// Note each `workerbox` instance has it's own sandbox
const { run, destroy } = await createWorkerBox('https://sandbox.workerbox.net/');
let callback;
const scope = {
name: 'Mark',
getMessage: () => 'Have a great day!',
setCallback: fn => {
// You can store arguments, objects, arrays and returned values
// outside of the scope of your main app, and then call them
// from anywhere, so long as the worker is not destroyed.
callback = fn;
}
};
setInterval(() => {
if (callback) {
// This will communicate with the workerbox transparently.
callback();
}
});
// You can save state between running code
// But this will not save between different workerbox instances.
await run(`
globalThis.sharedVariable = 123
`);
const result = await run(`
// globalThis.sharedVariable === 123;
async function sayHello (who) {
return 'Hello ' + who + '. ' + await getMessage();
}
return sayHello(name);
`, scope);
// result === 'Hello Mark. Have a great day!'
// Destroys the workerbox, terminating the webworker
destroy()
Runtime errors should have readable stacktraces, for example:
The following code:
await run(`
const a = 1;
a();
`);
Should return the following error:
TypeError: a is not a function
at sandbox (<sandbox>:2:2)
However syntax errors will not have a stack trace, for example:
The following code:
await run(`
return 1 +
`);
Should return the following error:
Unexpected token '}'
It would be helpful for your users if you ran the script through a linter or ast parser, to ensure the JavaScript is valid, and provide useful errors if not.
If you want to check this project out locally, you can do the following:
git clone https://github.com/markwylde/workerbox.git
cd workerbox
npm install
npm run start
Visit https://0.0.0.0:8002 in your browser and make sure to ignore the TLS security errors. Web workers will only work in secure contexts, so we need to do this locally.
cd demo
npm install
npm run start
Visit https://0.0.0.0:8000 in your browser.
Build the server side component and run the tests:
npm run build
npm test
An iframe is inserted into the page from a completely separate domain.
The iframe then creates a web worker, and handles posting messages between the iframe, webworker and your own app.
Because the only communication between the user code and the workerbox is done through messaging, the argument inputs and outputs must all be JSON serializable.
FAQs
A secure sandbox to execute untrusted user JavaScript, in a web browser, without any risk to your own domain/site/page.
The npm package workerboxjs receives a total of 163 weekly downloads. As such, workerboxjs popularity was classified as not popular.
We found that workerboxjs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.