push-shate
v1.0.0
Published
ioing lib - stateful Function
Downloads
5
Readme
ShadowFunction
Secure and controlable embedded third-party code for your website.
gitbook: https://shadow-function.gitbook.io
Install:
$ npm install shadow-function --save
Test
Running demo:
$ npm start
Simulate the ISV code for security testing under demo/test.js.
Start
ShadowFunction
Simple example:
import { ShadowFunction, ShadowDocument } from 'shadow-function'
new ShadowFunction('console.log(a + b)')({
a: 1,
b: 2,
console
}) // 3
Operational authority configuration:
let shadowFunction
shadowFunction = new ShadowFunction({
Node: [
'nodeName',
'nodeType',
'textContent'
],
Element: [
'style',
'onblur',
'onfocus',
'onscroll',
'offsetWidth',
'offsetHeight',
'clientWidth',
'clientHeight',
'innerText',
'setAttribute',
'removeAttribute',
'createTextNode',
'addEventListener',
'getElementsByTagName'
],
HTMLDivElement: []
})
shadowFunction(`
document.appendChild(document.createElement("div"))
`)({
document
})
Prototype chain restriction
new ShadowFunction('console.log(a.prototype)')({
console,
a: {}
}) // undefined
new ShadowFunction('console.log(a.valueOf.__proto__)')({
console,
a: {}
}) // undefined
ShadowDocument
Secure and controllable method of creating nodes.
import { ShadowFunction, ShadowDocument } from 'shadow-function'
new ShadowFunction('console.log(a + b)')({a: 1, b: 2, console}) // 3
let shadowDocumentFn = new ShadowDocument(document.body, '<div>123</div>')
shadowDocumentFn(`
document.body.append($template.content);
console.log(document.body.getElementsByTagName("div")[0].innerText)
`)({
console
})
Safe jsonp
import { jsonp } from 'shadow-function'
jsonp({
url: "http://suggest.taobao.com/sug?code=utf-8&q=iphoneX"
}).then((data) => {
console.log("jsonp:", data)
})