JavaScript in JavaScript (js.js): sandboxing third-party scripts

Running on billions of today’s computing devices, JavaScript has become a ubiquitous platform for deploy-ing web applications. Unfortunately, an application de-veloper who wishes to include a third-party script must enter into an implicit trust relationship with the third-party—granting it unmediated access to its entire appli-cation content. In this paper, we present js.js, a JavaScript interpreter (which runs in JavaScript) that allows an application to execute a third-party script inside a completely isolated, sandboxed environment. An application can, at runtime, create and interact with the objects, properties, and meth-ods available from within the sandboxed environment, giving it complete control over the third-party script. js.js supports the full range of the JavaScript language, is compatible with major browsers, and is resilient to at-tacks from malicious scripts. We conduct a performance evaluation quantifying the overhead of using js.js and present an example of using js.js to execute Twitter’s Tweet Button API.