Elevated library layer

Jan 15, 2015 at 9:14 AM
hi

I want to use ClearScript to implement a small JavaScript plugin environment. Now I would like to implement a JavaScript library layer which has access to security relevant host functionality while the actual plugin code I am going to execute has not. Plugin code should only have access to the library layer.
My first idea was to expose the necessary host objects only as local variables in functions of the library layer. However, I have not found a way to do this.
Is there any way to achieve this "elevated" library layer?
Coordinator
Jan 15, 2015 at 12:49 PM
Edited Jan 15, 2015 at 1:04 PM
Hello Querty,

Suppose you have a class that provides sensitive host functionality:
public class HostLib {
    public void Log(string message) {
        Console.WriteLine(message);
    }
}
Here's how you might create a script library that uses that class without exposing it to other script code:
dynamic createScriptLib = engine.Evaluate(@"
    (function (hostLib) {
        return {
            log: function (message) {
                hostLib.Log(message);
            }
        };
    }).valueOf()
");

engine.Script.lib = createScriptLib(new HostLib());
With this setup, additional script code (such as the plugin code) can invoke the "elevated" library (e.g., lib.log('Hello, world!')), but it has no access to the host object that provides the underlying functionality.

Good luck!
Marked as answer by Querty on 1/15/2015 at 1:38 PM
Jan 15, 2015 at 6:01 PM
This is just the idea I was looking for. Thanks!