JavaScript in JavaScript (js.js): sandboxing third-party scripts

摘要: Running on billions of today's computing devices, JavaScript has become a ubiquitous platform for deploying web applications. Unfortunately, an application developer who wishes to include third-party script must enter into implicit trust relationship with the third-party--granting it unmediated access its entire content. In this paper, we present js.js, interpreter (which runs in JavaScript) that allows execute inside completely isolated, sandboxed environment. An can, at runtime, create and interact objects, properties, methods available from within environment, giving complete control over script. js.js supports full range language, is compatible major browsers, resilient attacks malicious scripts. We conduct performance evaluation quantifying overhead using example Twitter's Tweet Button API.