[Paper Review] SafeJS: Hermetic Sandboxing for JavaScript

Damien Cassou, Sté́phane Ducasse+1 more|arXiv (Cornell University)|Sep 16, 2013

Security and Verification in Computing5 references3 citations

TL;DR

SafeJS provides a hermetic sandboxing solution for JavaScript by isolating untrusted scripts in web workers with a virtual DOM (VDOM), ensuring no direct access to the real DOM. It enforces security through string-based message passing and configurable policies, successfully enabling safe execution of external scripts in industrial use.

ABSTRACT

Isolating programs is an important mechanism to support more secure applications. Isolating program in dynamic languages such as JavaScript is even more challenging since reflective operations can circumvent simple mechanisms that could protect program parts. In this article we present SafeJS, an approach and implementation that offers isolation based on separate sandboxes and control of information exchanged between them. In SafeJS, sandboxes based on web workers do not share any data. Data exchanged between sandboxes is solely based on strings. Using different policies, this infrastructure supports the isolation of the different scripts that usually populate web pages. A foreign component cannot modify the main DOM tree in unexpected manner. Our SafeJS implementation is currently being used in an industrial setting in the context of the Resilience FUI 12 project.

Motivation & Objective

• Address the security risks of executing untrusted JavaScript in web mashups, where external scripts can access or modify the main DOM unexpectedly.
• Overcome limitations of existing solutions that rely on code rewriting or restricted JavaScript subsets, which hinder compatibility.
• Provide a secure, production-ready sandboxing mechanism that preserves full script compatibility while enforcing strong isolation.
• Enable safe integration of third-party scripts in web applications without compromising the integrity of the main document or user data.

Proposed method

• Isolate untrusted JavaScript code by executing it within dedicated web workers, which are inherently sandboxed from the main thread and the DOM.
• Implement a SafeJS Virtual DOM (VDOM) that mirrors the standard DOM but restricts modifications to only those permitted by configurable policies.
• Use string-based message passing between workers and the main thread to relay DOM updates, ensuring no direct object references or shared state.
• Validate all proposed DOM updates against security policies before applying them to the real DOM, with options to ignore or terminate malicious scripts.
• Extend jsdom to create a browser-compatible, non-blocking VDOM implementation that avoids file system access and C++ dependencies.
• Leverage RequireJS for asynchronous module loading to ensure compatibility with client-side execution environments.

Experimental results

Research questions

• RQ1 How can untrusted JavaScript scripts be securely isolated in a web browser without modifying the scripts themselves?
• RQ2 What architectural patterns enable strong isolation in dynamic, reflective languages like JavaScript, especially when reflection can bypass simple access controls?
• RQ3 Can a virtual DOM implementation be made both standards-compliant and secure in a client-side environment with no server-side dependencies?
• RQ4 How can communication between isolated scripts and the main page be controlled to prevent data exfiltration or unauthorized DOM manipulation?
• RQ5 Is it feasible to build a production-grade, hermetic sandboxing system for JavaScript that is both performant and compatible with existing web applications?

Key findings

• SafeJS successfully isolates untrusted JavaScript scripts using web workers and a virtual DOM, preventing direct access to the real DOM and eliminating data leakage risks.
• The SafeJS VDOM is a fully functional, browser-compatible implementation of DOM Level 3, built on a modified, non-blocking version of jsdom.
• The system supports configurable policies (e.g., read-only, read-write) to control what operations external scripts can perform on the target DOM nodes.
• Unsafe updates are detected and either blocked or lead to worker termination based on configuration, ensuring strong security guarantees.
• The implementation has been deployed in an industrial setting within the Resilience FUI 12 project, demonstrating real-world viability and production readiness.
• The approach maintains full compatibility with existing JavaScript code, requiring no modifications to untrusted scripts for sandboxing.