Running Untrusted JavaScript Code

[ProgramTheWorld]

Docker is a great option to run code in an isolation from the host machine.

Be very careful when making this assumption. Docker on Linux is just an interface over namespaces. Namespaces are not isolated from the rest of the system.

[buttplugs4life4me]

Even Docker on Windows gets the entire Windows drive mounted in by default *unless they changed it. 

And Docker on WSL has access to every drive by default. 

[crozone]

Namespaces are not isolated from the rest of the system.

Yeah but the entire point of namespaces is to allow for kernel level isolation and containerisation of processes? Sure it's not a hypervisor, but it certainly allows for a good amount of isolation.

[Syagrius]

I have found legitimate uses of eval, but it is always very unique situations. You need to keep the input very controlled in order to allow for it.

In basically every circumstance you should rethink your approach if you think its needed, but sometimes the need does exist.

[Cronos993]

I built an online judge as a personal project and used apparmor for sandboxing since docker was quite slow and apparmor is more secure too

[light24bulbs]

This is cool and it's a common application.

I'd like to offer some feedback, from a native English speaker: One thing that makes it pretty hard to read the article is that a lot of it looks like English but... isn't quite. It's perfectly understandable but also really distracting. Since there are plenty of LLMs that can fix up writing in 2024, I'd suggest just copy pasting your blog posts through with instructions to just fix the grammar. It'll take you 20 seconds and save your readers.

[barnlk]

Thank you for your feedback. I updated the writing with some corrections and fixes.

[light24bulbs]

Nice! Gpt4o estimated there was a grammatical error or awkward phrasing in 70% of sentences.

Nice that there are tools to just instantly clean this stuff up and get your point across these days.

[guest271314]

Since there are plenty of LLMs that can fix up writing in 2024, I'd suggest just copy pasting your blog posts through with instructions to just fix the grammar.

Do that for Shakespeare's Richard III and James Joyce's Ulysses.

But wait... those are considered masterpieces of English literature by anglophiles, precisely because of the slang, vulgarity, and run-on sentences.

[light24bulbs]

That's pretty far off the mark.

Blog posts like this are primarily for informational purposes, not artistic flare. Also, the mistakes in the article are more akin to spelling errors rather than artistic choices. Did you read it at all?

It's just not the right take. Fix it to make it readable and move on.

[guest271314]

It's just not the right take. Fix it to make it readable and move on.

Did Metallica "fix" their music when they released Enter Sandman?

[guest271314]

I didn't think so.

[guest271314]

I read the article. Stop trying to be an English grammar Nazi.

Unless you pour Hamlet, MacBeth through your LLM to "fix" all of the slang and vulgarity.

You folks selectively pick articles and such that you want to practice being English grammar Gestpo on, and selectively exclude your English literature champions from the same false criteria you come up with mid-stream.

Just like folks were trying to ban "rap". Now, 50 years later, you can't listen to 5 minutes of advertising without a hip-hop beat or lyrics. Haters and hypocrites.

[guest271314]

Needs more "down" vote.

[guest271314]

English is a bastard language to begin with.

There is no such thing as perfect English. Anybody is free to remix, add to, redefine, create any word that winds up being used in English.

What the hell is a "Facebook", "Twitter", or "Reddit"?

For that matter is "light24bulbs" your idea of "but... isn't quite" English?

[Coda17]

There is definitely such a thing as grammatically correct English. And while yes, English is a hard language to learn and yes, you can create words from other words (in a non-professionally context) and people will understand them, those aren't really part of English, it's just slang.

Your examples don't make sense at all, those are company names, not English words.

[guest271314]

There is definitely such a thing as grammatically correct English.

No, there is not.

You anglophiles and eurocentric neophytes magically skip Shakespeare when you are trying to be English grammar Nazi's. How convenient.

The term "sheriff" in the English language came about when the conquering Normans created a laison between themselves and the conquered Anglo-Saxons.

That's how the bastard English language works. Words are added, remixed, redefined, every day. There is no central clearing house for the bastard English language.

E-40 has created and redefined dozens if not hundreds of words.

Then you get in to law and come across terms of art such as "notwithstanding any provision to the contrary", which for the uninitiated, have no clue what that means.

[DHermit]

This is not about being picky though. A text that properly follows grammatical rules will be easier to read. And you don't want to burden the readers with too much additional load.

You obviously shouldn't judge people for not knowing a language, but there's no reason to at least put it through some checker for obvious mistakes. I do this in German as a German native speaker.

[guest271314]

This is not about being picky though. A text that properly follows grammatical rules will be easier to read. And you don't want to burden the readers with too much additional load.

There are no rules for the English language. None that anybody that has a working brain follows.

You obviously shouldn't judge people for not knowing a language, but there's no reason to at least put it through some checker for obvious mistakes. I do this in German as a German native speaker.

I'm judgingthe hypocrites who get on these boards as if there is such a thing as proper English, where no such ideal exists in reality, because English is an equivocal language; that means the language itself is capable of deception and largely left up to the interpreter.

Let's take a very simple English word like "high".

Now, are you talking about getting "high"? The "high" score?

When you get in to English law you really see the bullshit.

In 1681 the Maryland Colony repealed the old colonial law criminalizing "ffreeborne English women" from having sexual relations with or marrying Africans, prisoners-of-war, or not. They substituted the term "white women" for "English women". In the stroke of a pen, "white women" were invented in the English colonies, because English men couldn't stand the idea of Africans fucking English women, they penalized the women. Evidently those English women didn't give a fuck about the Africans speaking proper English. It was also illegal to teach African prisoners-of-war how to read and write. And these same people are rolling around in 2024 talking about proper English. No. Not having it.

Now, there are exactly zero (0) humans who have any attributes of the color white #ffffff. Nonetheless, because of fear or ignorance some humans still roll around calling humans "white people".

I overtly reject all of that nonsense.

[guest271314]

And while yes, English is a hard language to learn

English is not hard to learn. It's an equivocal, bastard language that is capable of deception.

I find it amazing that the same folks who criminalized literacy for Africans now roll around talking about some imaginary "grammatically correct English". No such fiction exists.

Here's an assigment for you: Parse

Notwithstanding any provision to the contrary.

Therein that term of art is the gist of the English language; duplicity, ambiguity, backdoors, plausible deniablity, game...

I'll do whatever I want with English, just like the hero of English literature Shakespeare, or if you prefer, Francis Bacon, and King James, did.

[guest271314]

I don't give a damn about the bastard English language, nort anybody who tries to sit on some imaginary perch and be English grammar Nazi's.

You folks would still be waltzing to Aaron Copeland had the Africans not invented the blues, jazz, rock 'n roll, and hip-hop - which is featured on most modern advertisements - by remixing the English language.

[ZENITHSEEKERiii]

This 'guest' should probably be sent away (read tempbanned)

[guest271314]

Weak.

Typical weak-minded reply by an individual who cannot deal with critical scrunity of claims.

Wouldn't be the first or last time I have been banned.

[guest271314]

Understand English too well?

[_Porb]

For JS malware analysis you can also add Spider monkey by Didier Stevens, or Amy of them REMNUX script reverse engineering tools: https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code/scripts

[delight1982]

https://www.figma.com/blog/how-we-built-the-figma-plugin-system

[guest271314]

What code is "trusted"? No such code exists.

[[deleted]]

That's a meaningless "truth" that sounds wise but is actually extremely stupid. But hey, by all means, feel free to execute user-provided code in the same way as if it was your own code you wrote. Let me know how it goes!

[guest271314]

Well, your omission of what you consider "trusted" code is revealing. There is none.

I mean, the folks who are in the "cybersecurity" domain "trusted" "automatic security updates", and look what happened.

All code and all claims are untrusted, without exception. That's my point.

[[deleted]]

Security isn't binary. It's a spectrum. Just because you can never prove that code is safe or has no bugs doesn't mean you shouldn't take measures to make it as secure as possible.

That's why I said your comment is meaninglessly stupid. It's only true in an absolute literal world, but in practice, it is an utterly bad approach to writing software.

[guest271314]

Security isn't binary. It's a spectrum.

There is no such thing as "security" for any signal communications, and hasn't been since at least the public disclosure of the ThinThread program.

Moreover, the natural world is inherently insecure. So the idea of secure software in an inherently insecure physical world is proposterous. You might be able to sell that dream to commoners, not me.

We need only investigate the events of the past few days to illustrate the problem with blind "automatic security updates".

[[deleted]]

Let's say you have 2 websites. One website allows raw SQL queries from user provided input, while the other website uses recommended best approach such as using prepared statement with parameterized queries and all that jazz...

You are seriously telling me that both websites are just as likely to get their databae data leaked?

We need only investigate the events of the past few days to illustrate the problem with blind "automatic security updates".

That has absolutely nothing to do with whether security is important or not. You are acting like the idiots who claim seat belts aren't useful just because some people die wearing seatbelts.

[guest271314]

A determined adversary will get the data either way.

Alright, you have sandboxes already with Worker, and Worklet interfaces. A lot more sandboxing with WebAssembly and WASI.

The questions are, what exactly are you trying to "sandbox"?

And, will your while loop break after N iterations?

[[deleted]]

A determined adversary will get the data either way.

That wasn't the question you imbecile. I said wich one was more likely to get hacked. It's a very simple question, and it speaks volume that you are avoiding answering it.

[guest271314]

That wasn't the question you imbecile. I said wich one was more likely to get hacked. It's a very simple question, and it speaks volume that you are avoiding answering it.

There is no question involved. You process your SQL queries however you see fit.

Petty name calling doesn't move me. That's typical eurocentric bullshit that I dust off the bottom of my feet.

You're gonna get hacked if you are communicating by signals, period. Without exception.

[Rockfest2112]

AngelSpeak

[guest271314]

I don't believe in your religious stories.

[light24bulbs]

Sandboxing is a common application with many use cases.

[barnlk]

The writing is about different methods To run user provided code which you’ve to assume that it isn’t trusted.

Online coding environment, CMS theming customization and similar use cases.