I was wondering if a web worker would be a secure way to sandbox untrusted javascript code. Let's say for example in the context of a drawing application where developers can implement new drawing tools, you could put their code inside a webworker, and any time the user clicks on the canvas, send them a JSON message containing the cursor position, and an array of image data, and when the script is done, it passes a message back containing the new image data.

Would this be secure, or are there risks I'm not thinking of?

I was wondering if a web worker would be a secure way to sandbox untrusted javascript code. Let's say for example in the context of a drawing application where developers can implement new drawing tools, you could put their code inside a webworker, and any time the user clicks on the canvas, send them a JSON message containing the cursor position, and an array of image data, and when the script is done, it passes a message back containing the new image data.

Would this be secure, or are there risks I'm not thinking of?

• javascript
• security
• web-worker

• 1 Have a look at Making WebWorkers a safe environment – Bergi Commented Oct 20, 2016 at 13:19

2 Answers 2

DOM is not available to the Web-workers, but it is possible to access same-origin stuff, like indexedDB. See my related question on this:

Can workers be secure enough for an untrusted code

The secure way is to use sandbox attribute of the iframe:

http://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/

Also take a look at my library which simplifies the process and provides the convenient connection with the sandbox (function export instead of messaging):

https://github.com/asvd/jailed

The problem with that is if the developers expect DOM access. Web Workers aren't allowed to handle DOM, unless the entire code is for data only.

I suggest you sandbox the entire app from the main domain, similar to how JSFiddle runs everything in iframes. That way, all potentially hazardous code can only work in that frame while all other things, like logins, are handled outside the frame, in the main domain away from the potentially dangerous code.

Best of all, just include safe code. Review the code before merging it in your main app.