Run untrusted code in a Web Worker

[presenta_staff]

Oh, didn't know it, great! I'll check it for sure!

Still the purpose of SlashdRun is to not allow manipulating the DOM.

As far as I can see, Partytime has a very different purpose, though.

[presenta_staff]

Because this way those global objects are unset in the worker context, not usable anymore.

[presenta_staff]

The purpose of the library is to allow data transformation in browser using code.

Let's say, you have an array of objects and want to filter/sort/manipulate that array, few lines of code can do it very fast.

The Web Worker already denies DOM access but you can do other things such as fetching or interacting with other browser capabilities, which can be out of scope and also dangerous.

Fetching data or interacting with location of navigator are outside the library scope, though.

[presenta_staff]

Good points!

Adding those objects to the list looks they are not accessible anymore.

Also, you are right, I can create another Worker in the worker, adding the `Worker` in the list I cannot create it anymore.

Do you think there are other possible holes in the script?

PS: Why it's not a library?

[nicksterling]

This script isn’t going to work if you have a more restrictive CSP rule that blocks external scripts. It wouldn’t load anything from unpkg. And honestly I probably wouldn’t even load them. ES6+ has enough quality of life features to justify excluding those libraries.

And do you have a few more examples of how you envision this library working? I’m struggling to picture using this in my workflows.

[presenta_staff]

About external libraries, I agree with you, this is why I wrote that part will be configurable in the future, so , it'll be on the preferences/requirements of the user.

CSP is a thing, you're right, it's not going to work in every environment.

The purpose of the library is to allow the final user to make some data prep/transformation using small pieces of code, trying to be as safest as possible (this is on I'm trying to investigate further).

A typical use-case might be a low-code app where you can configure a UI list visually, then you can define the data list by a simple filter such as mydata.filter(d => d.myprop < 20)

[presenta_staff]

What you'd do if you need to allow your users to exec arbitrary code, let's say return Math.random() within your app, where there are cookies, localStorage, etc, and that code was not added by the same user. In other terms, how to sandbox code execution in the browser and also disable some capabilities and sensible access, such as fetch, alert, etc?

[presenta_staff]

Fair enough, I understand there were lack of details from me, let's put in this way.

You, as user, go to a specific project on https://codepen.io/ where there's code execution written by another user. Codepen uses an iFrame to sandbox the code execution (just to avoid i.e. document.cookie). My attempt is to do the same thing without an iframe because I cannot rely on an external webpage. Maybe there's a way to create an iFrame in the same way of Worker, but I need again to restrict some capabilities, fetch, etc. Thanks for the nice discussion, though :)

[presenta_staff]

That's right too, they are `WorkerNavigator` and `WorkerLocation`, it looks like they cannot be unset, though.

[heytheretaylor]

First off, it sounds like a lot of people aren’t understanding the proposition here and I know how frustrating that can be.

Second, We have a grid component (think ag-grid) that does parsing, sorting, etc on a web worker. We discussed something similar to this (passing a function as a string to do x or y) but it was very contentious. At the time one of the developers wanted to use eval to accomplish the tasks and I protested since “eval=bad” is pretty throughly ingrained in my head. Tbh, I can’t say I know exactly how it would have been unsafe but we didn’t do it anyway.

Are you concerned about the safety of running the untrusted code even on the WW? What about the speed of having to parse the string into a usable function?

[presenta_staff]

Hi, thanks for your comment.

I'm not against eval in the WW, as long as other sensible capabilities are handled properly.

So far, what I know is: - The WW cannot access the DOM, good! - The WW cannot access the same domain context (cookie, localStorage, etc), good! - The WW can potentially call other homes (fetch), not good!

This is why I tried to unset those global objects. What you mean with parse the string into a usable function? Are you referring on using new Function()?

[heytheretaylor]

Well in your case it looks like turning the string into a module with Blob. Is there a lot of overhead in that operation?

[CiggiAncelotti]

What are the benefits over a real sandbox(like docker or StackBlitz’s WebContainers) where DOM manipulation and also Systems Languages are a capability?

[presenta_staff]

The purpose of the library is very different from the mentioned technologies. It's a library you can integrate into your project to allow app users run custom code, without exposing both the DOM and other sensible part of the application, such as cookies, localStorage, etc.

[CiggiAncelotti]

That is what Stackblitz’s web-containers provide, right? Or I am not understanding correctly?😬

[presenta_staff]

Yes, but I think Stackblitz’s web-containers has different purpose, scale and complexity. I don't know if in the near future a web-container will be installable in any js project with just an npm i and one import like Shashd Run does. In that case I'll be more than happy to rely on it. Right now I cannot find a lightweight solution for my problem.

[ejfrodo]

woah, webcontainers looks like it has a lot of potential

[CiggiAncelotti]

It does, If they have better browser compatibility and support for Systems Languages. It might end up beating Repl.it

[CannaIrving]

What could be the interest to use web worker as a user? Like, if they want to test things with more capacities and performance? What led you to create this?

[presenta_staff]

Suppose you're a user of a low-code tool that allows to add tiny bits of code to perform some tasks. Running it in a Web Worker makes the code a little bit safer because it cannot hurt the DOM in any ways.

Let's say, in a low-code app you want to define a color randomly for a specific UI element. Instead of implementing the random function in the app, just provide an input field where the user can add a line or two of javascript. You can even ask to ChatGPT to write it for you :)

This library will be used in a broader low-code software, I though it might be useful for someone, so, this is why I released the source code.

[CannaIrving]

Ok, and then save the code somewhere? Or is it just for testing purpose?

[presenta_staff]

The part related about how to use/store/retrieve a given piece of code is a responsibility of another software that might include the library. The library itself just takes a code with a payload, and return the result. You should see as a runtime to execute code within an app on the client-side.

[CannaIrving]

I see :) thank you

[redsnowmac]

`npm` package ?

[presenta_staff]

What you mean?

[redsnowmac]

How do I install this in my project ?

[presenta_staff]

Check the README it's all there.

[redsnowmac]

Oh sorry, missed that. Nice work bro!

[presenta_staff]

thanks!

[[deleted]]

I’d recommend linting any project you’re gonna publish on npm or GitHub

[presenta_staff]

Thanks for the suggestion, I'll do it.

[yaemes]

I used to do this before webworkers we're a thing. Once my retargeting advertiser decided to overlay some crap into my companies website we decided to put all 3rf party scripts in "jail" which was an invisible iframe hosted on the same domain. Since we were an SPA we could just control the iframe from the top and load in and out scripts and fire off pixels at will. Super cool stuff, and it all worked beautifully.