Skip to content

Instantly share code, notes, and snippets.

@obenjiro
Last active March 29, 2017 10:34
Show Gist options
  • Save obenjiro/4132899 to your computer and use it in GitHub Desktop.
Save obenjiro/4132899 to your computer and use it in GitHub Desktop.
Prevent access to Document and Window objects
// http://jsbin.com/igonuh/1/edit
function Fx(){return function(){return -1;};}
function SafeThis(that){
if (that == window) {
return fakeWindow;
} else if (that == document) {
return fakeDocument;
} else {
return that;
}
}
var fakeDocument = {
write: function(a){ document.write(a + "<br>"); }
};
var fakeWindow = {
document: fakeDocument
};
var moduleA = function(Function, window, document, eval){
var f = new Function("return this");
document.write(f());
var win = (function(){return this;})();
document.write(win);
var set = (function(){this.a = 1;return this.a})();
document.write(set);
var e = eval("this");
document.write(e);
document.write(this);
document.write(window);
document.write(document);
this.a = 1;
document.write(JSON.stringify(this));
};
var moduleA_Fx = '!' +
moduleA.toString().replace(/\bthis\b/g,"SafeThis(this)") +
'(Fx,fakeWindow,fakeDocument,Fx)';
document.write(moduleA_Fx + "<br><br>");
eval(moduleA_Fx);
document.write(this.a);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment