Sandboxed div:

The JavaScript in the sandbox generally follows the rules of ADsafe:

• Use of eval, with, ==, !=, and the subscript operator [] are not allowed.
• Limited access to this and global variables.
• These properties may not be used: apply arguments call callee caller constructor eval prototype this unwatch valueOf watch and anything beginning or ending with __.

The following global variables are accessible:

• element - This the root element of the sandbox. Sandboxed elements do not have access to relational properties (parentNode, firstSibling, nextSibling, etc.). You can still use DOM methods and string properties like innerHTML. The style object can also be used (accessed and modified) as well.
• document - This is a sandboxed document object that provides node creation and basic element searching facilities. The sandboxed document provides the following methods: getElementById, createElement, createTextNode, and write.

The following standard JavaScript/DOM functions/constructors and (their child functions when applicable) may be called. They may only be used in call position, they may not be accessed in any other way. They generally behave as the standard JavaScript function, unless otherwise noted:

• isNaN
• isFinite
• parseInt
• parseFloat
• escape
• unescape
• encodeURI
• encodeURIComponent
• decodeURI
• decodeURIComponent
• alert
• confirm
• prompt
• Date
• RegExp
• Error
• Number
• Math
• setTimeout - This will only accept a function (not a string)
• setInterval - This will only accept a function (not a string)
• clearTimeout
• clearInterval

The following special functions are available to compensate for the JavaScript syntax limitations imposed by the sandbox:

• get(obj,prop) - This is a special function to handle accessing properties in lieu of the [] operator. Calling get(obj,prop) is equivalent to obj[prop].
• set(obj,prop,value) - This is a special function to handle modifying properties in lieu of the [] operator. Calling set(obj,prop,value) is equivalent to obj[prop]=value.
• forEach(obj,func) - This is a special function to iterate through all the properties in an object, or items in an array. For each item, the func function will be called with the item as the first argument, the index as the second, and the obj as the third
• Class(superclass..., properties, classProperties) - The this operator may only be used in class definitions. secure.sandbox provides Class as a class constructor. The following argument are accepted:
  • superclass: There may be zero or more superclass arguments. The constructed class will inherit from any provided superclasses, protypically from the first, via mixin for the subsequent. Later arguments will override properties/methods from earlier arguments
  • properties: The constructed "class" will also have the methods/properties defined in this argument. These methods may utilize the this operator, and they are only the code that has access to this. Inner functions are also prohibited from using this. If no superclasses are provided, this object will be the prototype of the constructed class (no copying will be done). Consequently you can "beget" by calling new (Class(obj)). All methods are "bound", each call results in |this| safety checking call.
  • classProperties: This properties will be copied to the new class function.
  Note that neither dojo.declare nor dojo.extend are acceptable class constructors as they are unsecure. This class constructor is conceptually based on declare but also somewhat influenced by base2, prototype, YUI, resig's patterns, etc.

The following functions for DOM manipulation and extra language features are provided by the Dojo library. This represents a safe subset of Dojo. All Dojo library functions are provided as top level functions, namespacing is unnecessary because scripts do have access to modify the global object, and can't define global variables. Thus, you can call Dojo functions directly, for example you can call mixin(obj,mixinObj). You may also use the traditional syntax (dojox.mixin(...)). Here are a list of available functions:

• mixin
• require
• isString
• isArray
• isFunction
• isObject
• isArrayLike
• isAlien
• hitch
• delegate
• partial
• trim
• connect
• disconnect
• subscribe
• unsubscribe
• Deferred
• toJson
• fromJson
• style
• attr
• query - This will only search within the sandbox.
• byId
• body - This returns the root element of the sandbox