String Utility Belt sandboxes user JavaScript with layered iframe and CSP isolation

·1 views

The developer of String Utility Belt, a browser tool for chaining text transformations, added a custom JavaScript step that lets users write their own functions. Because users often paste sensitive data such as JWTs, Kubernetes secrets, and production API keys, and pipelines are shared via links, the code needed strong isolation. The solution runs user code inside a four-layer sandbox: a srcdoc iframe with an opaque origin, a strict per-frame Content-Security-Policy that blocks all network access, and a Web Worker that can be terminated when it exceeds its time limit. Each run uses a fresh frame that is removed afterwards, so nothing persists between runs. The article describes how this strict CSP initially broke the sandbox when it was enabled.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Running User JavaScript Under a Strict CSP Using eval()

A DEV Community post by Murray le Roux examines how to execute user-supplied JavaScript while operating under a strict Content Security Policy. The article is tagged with javascript, security, webdev, and csp topics. The post reportedly takes about 14 minutes to read. The excerpt provided does not include the body text describing the methods or conclusions. A full version of the article would be needed to produce an accurate four-to-five sentence summary.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing YouTube's 'Sign in to confirm you're not a bot' error on cloud servers

Developers running transcript code on AWS, Vercel, Render, or VPS hosts often hit a LOGIN_REQUIRED error saying the request looks like a bot. The article explains that YouTube flags cloud and datacenter IP ranges as scrapers, so the problem comes from the server's location rather than the code itself. It advises first checking the error reason, since some failures like private or age-restricted videos cannot be fixed by retrying. Suggested remedies include installing a JavaScript runtime for yt-dlp, switching YouTube client types, using cookies from a throwaway account, PO tokens, or residential proxies, each with trade-offs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Detecting Silent Failures: API Error Rates, Cron Success Timestamps, and Alert Testing

A DEV Community guide argues that reliable failure detection depends on signals that distinguish genuine outcomes from mere completed requests. It recommends counting API outcomes by category, recording whether scheduled jobs meet a completion check, and tracking the timestamp of the last verified success to catch jobs that never ran. The author suggests running the poller outside the observed job, with a deadline and a completion predicate taken from the API contract. It also warns against putting identifiers, tokens, or raw error text into metric labels, since these create high cardinality and can expose sensitive data. Diagnostic detail is better kept in access-controlled logs, with metrics, logs, and traces each handling a distinct job.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Audit Finds Gas-Heavy Design in Polygon Bridge, Rates Risk 4/10

A gas-efficiency review of the Polygon Bridge, which links Ethereum and Polygon PoS and holds roughly $2.6 billion in assets, examined its most frequently called functions. Auditors identified redundant storage operations, inefficient calldata handling, duplicated access checks, and legacy SafeMath code that inflate transaction costs. The review found no critical security flaws caused directly by these inefficiencies. However, it warned that the high gas costs could enable denial-of-service tactics, front-running of withdrawals, and congestion during periods of market stress, and assigned the bridge a risk score of 4 out of 10.

0 comments Read more at DEV Community