JavaScript in JavaScript (js.js): Sandboxing third-party scripts Jeff Terrace, Stephen R. Beard, and Naga Praveen Kumar Katta Princeton University Abstract script to execute only what is expected of it. The third- party, however, has full access to the application. It could Running on billions of today’s computing devices, redirect the page, modify the DOM, or insert malware. JavaScript has become a ubiquitous platform for deploy- ing web applications. Unfortunately, an application de- An application owner could download the third-party veloper who wishes to include a third-party script must script and serve it from his or her own servers. This enter into an implicit trust relationship with the third- at least ensures that the script being run by the applica- party—granting it unmediated access to its entire appli- tion hasn’t been modified without the application owner cation content. knowing. However, this is not always possible with dynamically-generated scripts (e.g., advertisements), and In this paper, we present js.js, a JavaScript interpreter it still doesn’t ensure that the third-party script is not ma- (which runs in JavaScript) that allows an application to licious. Third-party services often compress their code execute a third-party script inside a completely isolated, (e.g., using the closure compiler), producing a large soup sandboxed environment. An application can, at runtime, of JavaScript that can make it very difficult for a human create and interact with the objects, properties, and meth- or static analyzer to verify its behavior. Alternatively, ods available from within the sandboxed environment, the application could include the third-party scripts in an giving it complete control over the third-party script. js.js iframe, but iframes still have privileges (e.g., alerts, redi- supports the full range of the JavaScript language, is rection, etc.) that the application might want to disallow. compatible with major browsers, and is resilient to at- It also requires cumbersome inter-iframe messaging for tacks from malicious scripts. communication. We conduct a performance evaluation quantifying the overhead of using js.js and present an example of using Static analyzers can be used to rewrite third-party js.js to execute Twitter’s Tweet Button API. JavaScript [16, 9, 2, 17] before it gets executed. This is often used on small, user-submitted widgets to guaran- tee their safety, but doesn’t provide flexible, fine-grained 1 Introduction control over the third-party script’s privileges, and there- fore, are not applicable to large, third-party libraries. The web has undoubtedly become one of the most Other approaches extend the browser itself to provide dominant application deployment platforms. Thanks to security mechanisms for third-party scripts [12]. While its wide support from today’s consumer devices—from a nice approach, adopting a new standard in all major desktops and laptops to tablets and smartphones—the browsers is difficult and breaks backwards-compatibility. web’s scripting language, JavaScript, is available on bil- In this paper, we present js.js, a JavaScript interpreter lions of devices. that runs on top of JavaScript. It allows site operators One problem facing a web application developer is to mediate access to a page’s internals by executing a the implicit trust of including third-party scripts. A third-party script inside a secure sandbox. We created a third-party script is a JavaScript file included from a prototype js.js implementation by compiling the Spider- party other than the application owner. Examples of Monkey [3] JavaScript engine to LLVM [11] and then commonly used third-party scripts are Google Analytics, translating it to JavaScript using Emscripten [20]. The Facebook’s Like button, Twitter’s Tweet buttons, and ad- implementation is used to demonstrate the js.js API se- vertising platforms. When including one of these third- curity features and benchmark performance on the Sun- party scripts, the application is trusting the third-party Spider benchmark suite [4]. 1 Browser Page var src="nativeAdd(17, 2.4);"; var jsObjs=JSJS.Init(); js.js Library function nativeAdd(d1, d2){ Mediator return d1+ d2; Sandboxed Script } var dblType=JSJS.Types.double; Virtual DOM var wrappedNativeFunc=JSJS.wrapFunction({ func: nativeAdd, window args:[dblType, dblType], document DOM returns: dblType}); JSJS.DefineFunction(jsObjs.cx, jsObjs.glob, "nativeAdd", wrappedNativeFunc, 2, 0); var rval=JSJS.EvaluateScript(jsObjs.cx, Figure 1: js.js architecture for example application jsObjs.glob, src); 2 Design //Convert result to native value vard= rval&&JSJS.ValueToNumber(jsObjs.cx , rval); The design goals for js.js are as follows: • Fine-grained control: Rather than course-grained control, e.g., disallowing all DOM access, an appli- Figure 2: Example of binding a native function to the cation should have fine-grained control over what global object space of a sandboxed script. actions a third-party script can perform. • Full JavaScript Support: The full JavaScript lan- guage should be supported, including with and eval, tor intercepts all access, such that it can allow or reject which are impossible to support with static analysis. requests. • Browser Compatibility: All major browsers should be supported without plugins or modifica- The js.js API aims to be easy to use and flexible. The tions. example in Figure 2 demonstrates using the API to bind • Resilient to attacks: Resilient to possible attacks to the sandboxed environment, a global function called nativeAdd such as page redirection, spin loops, and memory that accepts two numbers as arguments and re- exhaustion. turns the sum. Init initializes a sandboxed environment with standard JavaScript classes and an empty global ob- With these goals in mind, the js.js API has been de- ject. wrapFunction is a helper function that allows an signed to be very generic, similar in structure to the Spi- application to specify expected types of a function call. derMonkey API. Rather than being specific to a web en- If the wrong types are passed to the function, an error is vironment, the js.js API can be used to bind any kind of triggered in the sandbox space, which will result in an global object inside the sandbox space. Initially, a sand- error handler being called in native space, allowing ap- boxed script has no access to any global variables ex- plications to detect sandboxed errors. DefineFunction cept for JavaScript built-in types (e.g., Array, Date, and binds the wrapped function to a name in the global ob- String), but the application can add additional names. In ject space of the sandbox, EvaluateScript executes the web environment, these include global names like the script, and ValueToNumber converts the result of window and document. The js.js API allows an applica- evaluating the expression to a native number. tion, for example, to add a global name called alert that, when called inside the sandbox, calls a native JavaScript In addition to primitive types like bool, int, and dou- function. This way, the application using js.js has com- ble, the js.js API also includes helper functions for bind- plete control over the sandboxed script since the only ing more complex types like objects, arrays, and func- access the sandbox has to the outside is through these tions to the sandboxed space. With the js.js API, an ap- user defined methods. Thus these methods must give the plication can expose whatever functionality of the DOM script access only to the elements that the user allows. it wants to a sandboxed script. It can also be used to run Figure 1 shows an example application architecture user-submitted scripts in a secure way, even providing a using js.js. The Mediator is a JavaScript application that custom application-specific API to its users. Currently, uses the js.js library to execute a third-party script in a creating this virtualized DOM is fairly complex. As fu- sandbox. The Virtual DOM is comprised of the usual ture work, we wish to extend the js.js API to make it eas- web-specific global variables that a script expects, but ier to use by allowing the user to easily setup white/black instead of referring directly to the browser, the media- lists of browser elements, sites, etc. 2 Fine-Grained Full JS Page Spin Loop / Memory Suspend / DOM Control Support Redirection Terminate Exhaustion Resume Direct Include %!%%%% iframe %!%%%% Web Worker %!!!%% Static !%!%%% Static + Runtime !%!%%% js.js !!!!!! Figure 3: Table of related work and the attack vectors which they can protect against or support (!) and those that they cannot (%). “Static” refers to purely static techniques such as ADsafe and Gatekeeper, while “Static + Runtime” refers to techniques such as Caja and WebSandbox. The power of eval and with make them difficult to ex- late the LLVM bytecode to JavaScript. ecute securely. For example, malicious code can use eval Emscripten works by translating each LLVM instruc- to disable or circumvent any protections that have been tion into a line of JavaScript. Typed Arrays (a browser added through JavaScript code. Thus, most other tech- standard) allows Emscripten to emulate the native stack niques either completely prohibit using them or provide and heap, such that loads and stores can be translated to some limited version. However, the powerful sandbox- simple array accesses. When possible, Emscripten trans- ing of scripts that js.js employs means that even eval and lates operations to native JavaScript operations. For ex- with can be executed securely as they can still only ac- ample, an add operation is translated into a JavaScript cess the protected Virtual DOM. add operation. An LLVM function call is translated into Since js.js contains a full JavaScript interpreter (a a JavaScript function call. It also has its own version of a compiled version of SpiderMonkey in our prototype im- libc implementation.