How to run javascript inside browser safely and se

问题:

This question already has an answer here:

• How do I safely “eval” user code in a webpage? 4 answers

I need to eval() the code inside my page because I am working on something jsFiddle-like. Since eval has such a bad reputation, how can I interpret the user input code safely and securely? Or as safely and securely as possible?

回答1:

I would suggest you have a look at the following resources:

• https://code.google.com/p/jsreg/
• https://www.owasp.org/index.php/OWASP_JavaScript_Sandboxes
• http://www.thespanner.co.uk/2012/10/18/mentaljs-sandboxparser/

Anyway, you should consider running the code that's coming from untrusted users/sources on another domain than where your main site/content is located.