You can set the function environment that you run the untrusted code in via setfenv(). Here’s an outline: local env = {ipairs} setfenv(user_script, env) pcall(user_script) The user_script function can only access what is in its environment. So you can then explicitly add in the functions that you want the untrusted code to have access to … Read more
Google Caja is a source-to-source translator that “allows you to put untrusted third-party HTML and JavaScript inline in your page and still be secure.”
Edited to add information about the File API Since I originally wrote this answer, the File API has been proposed as a standard and implemented in most browsers (as of IE 10, which added support for FileReader API described here, though not yet the File API). The API is a bit more complicated than the … Read more
You can simply install a vncserver along with Firefox 🙂 I pushed an image, vnc/firefox, here: docker pull creack/firefox-vnc The image has been made with this Dockerfile: # Firefox over VNC # # VERSION 0.1 # DOCKER-VERSION 0.2 FROM ubuntu:12.04 # Make sure the package repository is up to date RUN echo “deb http://archive.ubuntu.com/ubuntu precise … Read more