---
id: 5492
title: "Attacking and defending JavaScript sandboxes"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/attacking-and-defending-javascript-sandboxes"
published_at: "2020-07-16T10:39:00Z"
tags: ["web-security", "sandbox-escape", "proxy", "defense", "code-execution", "javascript-sandbox"]
phying_url: "https://phying.com/item/5492"
lang: en
---

# Attacking and defending JavaScript sandboxes

## Summary

Attacking and defending JavaScript sandboxes: with-statement breakouts, prototype tampering and generator constructors defeat naive proxy sandboxes; checkSyntax and a hardened design are proposed.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-07-16T10:39:00Z
- **Original:** https://portswigger.net/research/attacking-and-defending-javascript-sandboxes
- **Phying News:** https://phying.com/item/5492