|
68
|
1 =============================
|
|
|
2 About SpiderMonkey Playground
|
|
|
3 =============================
|
|
|
4
|
|
|
5 This is a simple C/C++ command-line program that experiments with the
|
|
|
6 SpiderMonkey JavaScript engine.
|
|
|
7
|
|
|
8 File Layout
|
|
|
9 -----------
|
|
|
10
|
|
|
11 pavement.py Paver [1] script to build binaries.
|
|
|
12
|
|
|
13 sample-module.js Sample SecurableModule.
|
|
|
14
|
|
|
15 tcb.js Trusted Code Base script.
|
|
|
16
|
|
|
17 server-socket.cpp/h Simple native implementation of a JS socket
|
|
|
18 object.
|
|
|
19
|
|
|
20 memory_profiler.cpp/h Native memory profiling functionality.
|
|
|
21
|
|
|
22 memory_profiler_server.js Script to provide a RESTful web service
|
|
|
23 exposing memory profiling data about another
|
|
|
24 JS runtime.
|
|
17
|
25
|
|
68
|
26 wrapper.cpp/h Native implementation of JS wrapper/membrane.
|
|
|
27
|
|
|
28 spidermonkey-playground.cpp/h Main executable embedding SpiderMonkey and
|
|
|
29 implementing many global JS functions.
|
|
|
30
|
|
|
31 [1] http://www.blueskyonmars.com/projects/paver/
|
|
|
32
|
|
|
33 Usage
|
|
|
34 -----
|
|
|
35
|
|
|
36 (1) Modify pavement.py to your needs--it currently requires a full
|
|
|
37 build of Mozilla somewhere on your system, which is unfortunate,
|
|
|
38 but SpiderMonkey 1.8/1.8.1 hasn't yet been released as standalone.
|
|
|
39
|
|
|
40 (2) Build the binaries by running 'paver'.
|
|
|
41
|
|
|
42 (3) Run 'spidermonkey-playground'. Right now the executable just runs
|
|
|
43 some tests and starts the memory profiling server at the very end.
|
|
|
44
|
|
|
45 Security Experimentation
|
|
|
46 ------------------------
|
|
|
47
|
|
|
48 To experiment with security, we expose a number of the JSAPI's
|
|
|
49 functions [1] to a Trusted Code Base written in JS. The goal here is
|
|
|
50 to provide developers with an easy way to explore and experiment with
|
|
|
51 JavaScript security models in a high-level language before actually
|
|
|
52 implementing one in C/C++.
|
|
17
|
53
|
|
|
54 The playground currently includes a highly experimental implementation
|
|
|
55 of SecurableModules [2] that allows for the exportation of
|
|
|
56 functionality to a module via require(). It also includes a "membrane"
|
|
|
57 or "wrapper" [3] implementation that allows secure membranes to be
|
|
|
58 implemented entirely in JavaScript. It's really just an exposing of
|
|
|
59 SpiderMonkey's JSClass/JSExtendedClass [4] to JavaScript, but it
|
|
|
60 should allow for pretty flexible enforcement of any kind of desired
|
|
|
61 security characteristic, from an Object-Capability Model like that of
|
|
|
62 Google Caja [5] to a read-only representation of a DOM structure.
|
|
|
63
|
|
|
64 [1] https://developer.mozilla.org/en/SpiderMonkey
|
|
|
65 [2] https://wiki.mozilla.org/ServerJS/Modules/SecurableModules
|
|
|
66 [3] https://developer.mozilla.org/en/XPConnect_wrappers
|
|
|
67 [4] https://developer.mozilla.org/en/SpiderMonkey/JSAPI_Reference/JSClass
|
|
|
68 [5] http://code.google.com/p/google-caja/
|
|
68
|
69
|
|
|
70 Memory Profiling Experimentation
|
|
|
71 --------------------------------
|
|
|
72
|
|
|
73 A prototype implementation of a memory profiling web server providing
|
|
|
74 a REST API to the state of a frozen JS runtime is also provided. The
|
|
|
75 actual server is written using JavaScript, and runs in a separate
|
|
|
76 JS runtime from the frozen one that it exposes.
|
