I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node.

So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with the window state by running unsafe code through a full-blown parser that gets rid of all kinds of attack vectors, and then safely executing that code in an iframe of the same origin.

However, I am currently working on a solution using HTML5's Worker (see here) and it seems to have the same effect. What does Caja have to offer that Worker does not have, other than the ability to customize security policies? Does it have any additional safety features?

closed as off-topic by gnat, Bart van Ingen Schenau, user40980, GlenH7, World Engineer Apr 8 '14 at 0:08

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to recommend a tool, library or favorite off-site resource are off-topic for Programmers as they tend to attract opinionated answers and spam. Instead, describe the problem and what has been done so far to solve it." – gnat, Bart van Ingen Schenau, Community, GlenH7, World Engineer
If this question can be reworded to fit the rules in the help center, please edit the question.

  • meta.programmers.stackexchange.com/questions/6483/… (it's the same here as at Stack Overflow) – gnat Apr 6 '14 at 12:42
  • @gnat It's not a recommendation question. It is a clear cut question with a non-ambiguous answer: The set of attack vectors prevented by Caja that are not prevented by Worker is not subjective. – Domi Apr 6 '14 at 13:06
  • By asking for a comparison of Caja and Worker, your question reeks of a shopping-list question, which is off topic here. See also Q&A Is Hard, Let's Go Shopping – Bart van Ingen Schenau Apr 6 '14 at 15:34
  • @BartvanIngenSchenau How do you propose re-phrasing this question so it loses it stench? As I said before: The answer is not subjective. It is the same for everyone. This is an attempt to learn about differences between two seemingly valid approaches. I think there is great value to be gained from that, no? – Domi Apr 6 '14 at 15:44
  • @Domi: No, I don't know how to rewrite the question or I would have done so. – Bart van Ingen Schenau Apr 6 '14 at 16:52

Whether Caja has a security advantage depends on what your goals are.

These are the main features Caja offers for code sandboxing that all sandboxing methods currently available in browsers do not, as far as I know:

  • Synchronous interaction: you can define APIs which can be called by the guest code and respond immediately — they look like ordinary objects and functions. With workers, since they are explicitly threaded, all interaction must be via postMessage and therefore asynchronous.

    Further, if you write your code in the object-capability style it is possible to place both your own application and the user-supplied code within the Caja sandbox and have them interact in arbitrary ways without having to use any heavyweight intermediation at the boundaries between them.

  • Confinement: you can prohibit the guest code from communicating with third-party servers. This means you can execute untrusted code on private data without allowing it to leak that data (it can only return the results of its computation, or display it to the user).

If neither of these is interesting to you, then go ahead and use workers.

(There are additional things you can do with Caja for HTML, e.g. controlling external links, which I have not addressed here because you seem interested in running “headless” JS only.)

  • 1
    @Domi There was recently some discussion on the mailing list and I think someone may have mentioned working on SES + Node. I suggest you check the archives and ask for updates. – Kevin Reid Apr 7 '14 at 19:52
  • Thank you for your very insightful reply. Caja does not seem to work on Node yet. Are there any plans, or is there any chance for developer documentation that explains how to get some of its core features into Node without much effort? – Domi Apr 7 '14 at 19:52

Not the answer you're looking for? Browse other questions tagged or ask your own question.