I wonder, would it be possible to identify a
subset of Javascript that is benign? Perhaps some rules about which functions the script is permitted to use, along with restrictions on looping constructs (iterate through an array = OK; unbounded recursion = not OK)...
That way simple stuff like:
var form = document.forms[0];
document.getElementById('foo').addEventListener('change',
function (e) {
if (e.target.value == 'xyzzy')
form.elements['bar'].classList.add('show');
}
);
would be perfectly fine, but crazy "let's exploit the JIT" or "emulate an entire 8-bit home computer" stuff would be rejected.
And then, as a bonus, we could dump the entire JIT infrastructure and go back to a simple JS interpreter (a la Duktape) because there just wouldn't be much code left to interpret in the first place.
That way simple stuff like:
would be perfectly fine, but crazy "let's exploit the JIT" or "emulate an entire 8-bit home computer" stuff would be rejected.And then, as a bonus, we could dump the entire JIT infrastructure and go back to a simple JS interpreter (a la Duktape) because there just wouldn't be much code left to interpret in the first place.