caja

Google used to have Caja https://github.com/googlearchive/caja

> PHP code is not sandboxable People said the same about JavaScript, and yet smart people figured out ways to do it. For example: https://github.com/googlearchive/caja PHP may be particularly challenging to sandbox, but it's not too much for talented engineers to figure out. As a near-last resort, a secure PHP subset language could be developed.

The original SES doesn't seem to do anything to prevent meltdown/spectre attacks [1] This version removed direct access "Date" [2] but I'm not sure I'd trust any code running in the same process space given how hard it is to fix spectre in general. [1] https://github.com/google/caja/wiki/SES#current-date-and-tim... [2] https://github.com/Agoric/SES/tree/master/demo#taming-dateno...

Thanks. The "with(proxy)" part specifically would be mine. The old Google Caja, from the EcmaScript-5 days preceding Proxies, did something similar: https://github.com/google/caja/blob/master/src/com/google/ca... The full new pattern, combining "with(proxy)" with a clever use of direct "eval", is from Caridy Patino of Salesforce. The modern Realms Shim https://github.com/Agoric/realms-shim , and the SES Shim which builds on it https://github.com/Agoric/SES , is a collaboration of Agoric and Salesforce, especially JF Paradis of Salesforce. We have come to refer to the fragment of code with the "with(proxy)" and the direct "eval" as the "Eight magic lines of code" and "The heart of the shim". It is explained at https://www.youtube.com/watch?v=9Snbss_tawI&list=PLKr-mvz8uv... and https://www.youtube.com/watch?v=mSNxsn0pK74&list=PLKr-mvz8uv..

Well I'm surprised I haven't seen it yet, but I'm using Google Caja[0] for my own side project[1] (which, actually, I haven't touched in a while..) This allows plugin developers to create fully custom HTML plugins that run in the same frame (which is crucial for AudioNodes to be operated on by multiple plugins in my case.) Example of a plugin: https://github.com/lwansbrough/attack/blob/master/src/plugin... Actually my demo goes as far as showing how one plugin can register a resource that is then used by another plugin. In this case I developed a plugin which registers a high level interface for access to an Ableton Push 2 device, and then another plugin uses that interface to draw to the Push's display using the canvas API. https://twitter.com/lwansbrough/status/1125842014128312320 [0] https://github.com/google/caja [1] https://github.co

> That will transpile a restricted javascript (or whatever) into a runtime that just doesn't do these things? They already invented that: https://github.com/google/caja "Caja uses an object-capability security model to allow for a wide range of flexible security policies, so that your website can effectively control what embedded third party code can do with user data."

Your options, as I see them. 1. Text based ads only (no third party js) 2. HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify) 3. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and will require dev work on your side: * Google Caja https://github.com/google/caja * MentalJS https://github.com/hackvertor/MentalJS other options are available as well, in varying levels of maturity and support. I think using a sandbox iframe is not going to be able to defeat browser fingerprinting, because the sandbox control options are not rich enough. You would need to block all JS.

Also, Google has a tool called Caja that is open source: https://github.com/google/caja