olark/lightningjs — Issue #1: Safety with malicious code?
Author: tmcw
Created: 2011-10-25 18:22:33+00:00
State: open

Hi,

Extremely interesting project, and sorry I don't have a ton of time to kick the tires to answer this question myself - I might later today - but as far as safety, the main goal is to provide safety in terms of conflicts, not as far as sandboxing or preventing malicious third-party code fromm taking effect? It would seem that the `window.parent` is still fully accessible and common attacks like framebusting, cookie stealing, etc., are possible? Not saying that preventing those attacks should be a goal of this project - it seems like it's near-impossible and possibly not worth the effort without a Google Caja-like parsing/regeneration system.