disable Deno object in javascript

[amirhosseinvz94]

Hi,

I'm executing untrusted javascript (users script) inside deno, and i need to disable users to use Deno functionality like Deno.core or Deno.core.opAsync or anything related to Deno, how to do it?

[kitsonk]

You simply need to delete Deno.core before you run any of the untrusted code. For example:

delete_core.js

delete Deno.core;

main.js

import "./delete_core.js";

console.log(Deno.core); // undefined

All internal code binds early to Deno and Deno.core so deleting them won't impact downstream runtime code.

[amirhosseinvz94]

thanks mr kitsonk
but i need this Deno. api In the middle of executing the user code for myself(my handler functions ) or after running user script, my user do not have access to any concept of pure deno ( like any api for example Deno.core or Deno.Error or ... or any returned error from deno or anything ), somehow i do not want to user understand that behind of engine is deno
i think we can handle it in javascript with wrapper ( wrap Deno object with null ), but i think absolutely it has hole, And the user can get away with it, and i think maybe exist one way in rust side to user limitation and i think it is better way because user access to rust side is difficult

[zandaqo]

export const internalDeno = Deno.core;
delete Deno.core;

import { internalDeno } from 'delete_core.js';
console.log(Deno.core); // undefined
console.log(internalDeno); // { ... }

[leoc11]

Maybe you should consider running it on worker. By default the Deno namespace is not available in worker scope.

[amirhosseinvz94]

You mean web work?