231 reputation
15
bio website
location
age 32
visits member for 2 years, 11 months
seen 3 hours ago

Aug
21
awarded  Caucus
Aug
5
awarded  Yearling
Mar
2
answered blocking direct access to files via url input while still allowing a script on server to access files
Feb
27
answered Is it safe to store a single symmetric key encrypted with several different RSA public keys?
Dec
23
comment How to scan Javascript for malicious code?
@fms Yes, that explains it. I was using strict mode where it did not work.
Dec
21
comment How to scan Javascript for malicious code?
@D.W. Caja looks like a much more advanced version of my approach, as near as I can tell. (The others may be as well, I haven't looked closely.) With Google doing the work of defining the safe subset of Javascript, I wouldn't advise anyone to reinvent that wheel. So it remains to define the safe API within that framework of what an extension in a particular web application is allowed to do.
Dec
21
awarded  Editor
Dec
21
revised How to scan Javascript for malicious code?
added 246 characters in body
Dec
21
comment How to scan Javascript for malicious code?
@D.W. OK, that one works, and I am convinced that my approach is not feasible.
Dec
20
comment How to scan Javascript for malicious code?
@D.W. I tried running a script with "var w = []["sort"]["call"]();" and some variations in Firefox and IE. It errored out. Your parable doesn't seem to fit here well. You proposed one exploit that doesn't work against my scheme as presented, one that prompted me to clarify how to decide what goes in a whitelist, and then one that doesn't work at all.
Dec
20
comment How to scan Javascript for malicious code?
@D.W. You make a convincing argument for not whitelisting the keyword "this" (you can get equivalent functionality with closures), and to consider carefully which keywords to allow. I would go with just "var" and "function".
Dec
19
comment How to scan Javascript for malicious code?
@D.W. The proposed method is to build a whitelist of approved calls. A javascript instruction beginning with "eval" would not be allowed because "eval" is not part of the safe API.
Dec
16
awarded  Analytical
Dec
16
awarded  Teacher
Dec
16
answered How to scan Javascript for malicious code?
Dec
16
answered Store a password to avoid user interaction
Sep
6
awarded  Supporter